CVE-2021-26118CWE-284

CVE-2021-26118: vulnerability in Apache ActiveMQ Artemis

Flaw in ActiveMQ Artemis OpenWire support

Published · Updated

Follow this CVE+ Monitor Apache ActiveMQ Artemis+ Monitor org.apache.activemq:artemis-openwire-protocol

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.9%
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Affected products
Apache Software Foundation · Apache ActiveMQ Artemis
Related CVEs — Apache ActiveMQ Artemis

In the same product, most dangerous first.

CVE-2023-50780HIGHApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansEPSS 17.5%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 11.4%CVE-2022-23913—Apache ActiveMQ Artemis DoSEPSS 2.7%CVE-2022-35278—HTML Injection in ActiveMQ Artemis Web ConsoleEPSS 1.7%CVE-2026-57967CRITICALApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentEPSS 1.5%CVE-2026-67593CRITICALApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionEPSS 0.9%