CVE-2026-67593criticalCWE-306

CVE-2026-67593: falha crítica em Apache Artemis

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

Publicada em

Seguir esta CVE+ Monitorar Apache ActiveMQ Artemis+ Monitorar Apache Artemis

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.9%
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Apache Software Foundation · Apache ActiveMQ ArtemisApache Software Foundation · Apache Artemis
CVEs relacionadas — Apache Artemis

No mesmo produto, das mais perigosas para as menos.

CVE-2023-50780HIGHApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansEPSS 17.5%CVE-2026-27446CRITICALApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationEPSS 11.4%CVE-2021-26118—Flaw in ActiveMQ Artemis OpenWire supportEPSS 3.9%CVE-2022-23913—Apache ActiveMQ Artemis DoSEPSS 2.7%CVE-2022-35278—HTML Injection in ActiveMQ Artemis Web ConsoleEPSS 1.7%CVE-2026-57967CRITICALApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentEPSS 1.5%