Apache ActiveMQ Artemis vulnerabilities | LiveThreat CVE Feed

Product

Apache ActiveMQ Artemis

by Apache Software Foundation · last CVE Sep 10, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities12 In the news0 Timeline

Severity mix

Critical 4High 3Medium 5Low 0

Severity

All severities12 Critical4 High3 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Apache ActiveMQ Artemis to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-57967	9.8	1%	Sep 10	Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Affected: 1.0.0 through 2.44.0
CVE-2026-27446	9.8	11%	Mar 4	Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Affected: 2.11.0 through 2.44.0
CVE-2026-49364	9.1	1%	Sep 10	Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers Affected: 1.0.0 through 2.44.0; 1.0.0 through 2.44.0
CVE-2026-67593	9.1	1%	Sep 10	Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion Affected: 1.0.0 through 2.44.0; 2.32.0 through 2.44.0
CVE-2023-50780	8.8	17%	Oct 14	Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans Affected: before 2.29.0
CVE-2026-49362	7.5	1%	Sep 10	Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation Affected: 1.0.0 through 2.44.0
CVE-2026-49363	7.5	1%	Sep 10	Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription Affected: 1.0.0 through 2.44.0
CVE-2026-57822	6.5	1%	Sep 10	Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service Affected: 1.3.0 through 2.44.0
CVE-2026-75880	6.5	1%	Sep 10	Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service Affected: 1.0.0 through 2.44.0
CVE-2025-27391	6.5	0%	Apr 9	Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log Affected: 1.5.1 before 2.40.0
CVE-2026-32642	4.3	0%	Mar 24	Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission Affected: 2.0.0 through 2.44.0
CVE-2025-27427	4.3	1%	Apr 1	Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission Affected: 2.0.0 through 2.39.0