CVE-2026-57967

Advisory lineage Upstream: 0 Downstream: 1
Downstream
RHSA-2026:67604
Analyzed
Published: 10 Sept 2026, 04:43
Last modified:10 Sept 2026, 15:52

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.69% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Sept 2026, 04:43
Published
Vulnerability first disclosed
10 Sept 2026, 15:52
Last Modified
Vulnerability information updated

Description

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.69%• Percentile: 51%

Techniques & Countermeasures

  • CWE-306•Missing Authentication for Critical Function

    The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected Systems

  • apache software foundation•apache activemq artemis

    ≥ 1.0.0, ≤ 2.44.0

  • apache software foundation•apache artemis

    ≥ 2.50.0, ≤ 2.56.0

  • apache•artemis

    ≥ 1.0.0, < 2.44.0 | ≥ 2.50.0, < 2.57.0

References (2)