CVE-2026-49364

Advisory lineage Upstream: 0 Downstream: 1
Downstream
RHSA-2026:67604
Analyzed
Published: 10 Sept 2026, 04:49
Last modified:10 Sept 2026, 15:54

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (cve.org)
EPSS Score
0.38% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Sept 2026, 04:49
Published
Vulnerability first disclosed
10 Sept 2026, 15:54
Last Modified
Vulnerability information updated

Description

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.38%• Percentile: 32%

Techniques & Countermeasures

  • CWE-306•Missing Authentication for Critical Function

    The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected Systems

  • apache software foundation•apache activemq artemis

    ≥ 1.0.0, ≤ 2.44.0

  • apache software foundation•apache artemis

    ≥ 2.50.0, ≤ 2.56.0

  • apache•artemis

    ≥ 1.0.0, < 2.44.0 | ≥ 2.50.0, < 2.57.0

References (2)