Apache Artemis vulnerabilities

22 CVEs affecting Apache Artemis, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-75880, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-50780, published 2024-10-14. High severity, CVSS 8.8. EPSS: 17.5% chance of exploitation in the next 30 days. Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also…
CVE-2021-26117, published 2021-01-27. High severity, CVSS 7.5. EPSS: 11.3% chance of exploitation in the next 30 days. The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to…
CVE-2016-4978, published 2016-09-27. High severity, CVSS 7.2. EPSS: 6.9% chance of exploitation in the next 30 days. The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote…
CVE-2017-12174, published 2018-03-07. High severity, CVSS 7.5. EPSS: 6% chance of exploitation in the next 30 days. It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may…
CVE-2020-13932, published 2020-07-20. Medium severity, CVSS 6.1. EPSS: 4.3% chance of exploitation in the next 30 days. In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into…
CVE-2021-26118, published 2021-01-27. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the…
CVE-2021-4040, published 2022-08-24. Medium severity, CVSS 5.3. EPSS: 3.1% chance of exploitation in the next 30 days. A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt…
CVE-2022-23913, published 2022-02-04. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
CVE-2022-35278, published 2022-08-23. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
CVE-2026-57967, published 2026-09-10. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue…

Latest

CVE-2026-75880, published 2026-09-10. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker…
CVE-2026-67593, published 2026-09-10. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any…
CVE-2026-57822, published 2026-09-10. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter…
CVE-2026-49364, published 2026-09-10. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis:…
CVE-2026-49363, published 2026-09-10. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache…
CVE-2026-49362, published 2026-09-10. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects…
CVE-2026-40914, published 2026-05-28. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the…
CVE-2026-32642, published 2026-03-24. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a non-durable JMS topic…
CVE-2026-27446, published 2026-03-04. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker…