CVE-2026-49362

Advisory lineage Upstream: 0 Downstream: 1
Downstream
RHSA-2026:67604
Analyzed
Published: 10 Sept 2026, 04:56
Last modified:10 Sept 2026, 15:56

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.59% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Sept 2026, 04:56
Published
Vulnerability first disclosed
10 Sept 2026, 15:56
Last Modified
Vulnerability information updated

Description

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.59%• Percentile: 47%

Techniques & Countermeasures

  • CWE-306•Missing Authentication for Critical Function

    The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected Systems

  • apache software foundation•apache activemq artemis

    ≥ 1.0.0, ≤ 2.44.0

  • apache software foundation•apache artemis

    ≥ 2.50.0, ≤ 2.56.0

  • apache•artemis

    ≥ 1.0.0, < 2.44.0 | ≥ 2.50.0, < 2.57.0

References (2)