PT-2026-22892 · Apache · Apache Artemis+1

Hardik Mehta + 1 · Published 2026-03-04 · Updated 2026-06-15 · CVE-2026-27446

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.51.0 Apache ActiveMQ Artemis versions 2.11.0 through 2.44.0

Description A missing authentication check for a critical function exists in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can leverage the Core protocol to force a broker to establish an outbound Core federation connection to a rogue broker controlled by the attacker. This could lead to message injection into any queue and/or message exfiltration from any queue through the rogue broker. The issue impacts environments that permit both incoming Core protocol connections from untrusted sources and outgoing Core protocol connections to untrusted targets.

Recommendations Upgrade to Apache Artemis version 2.52.0. Remove Core protocol support from any acceptor receiving connections from untrusted sources. Use two-way SSL (certificate-based authentication) to require clients to present a valid SSL certificate before any message protocol handshake.

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-27446

GHSA-FW88-PF9M-P947

Affected Products

Apache Activemq Artemis

Apache Artemis

References · 21

• https://osv.dev/vulnerability/GHSA-fw88-pf9m-p947 · Vendor Advisory
• https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27446 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-27446 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-27446 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27446 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27446 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27446 · Vendor Advisory
• https://github.com/apache/artemis · Note
• http://openwall.com/lists/oss-security/2026/03/04/1 · Note
• https://t.me/CVEtracker/46299 · Telegram Post
• https://t.me/cveNotify/154269 · Telegram Post
• https://twitter.com/oss_security/status/2030575751309705246 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029127433538920793 · Twitter Post
• https://twitter.com/CVEnew/status/2029125968980263035 · Twitter Post