VDB
CVE-2026-49362
CVE-2026-49362
PUBLISHED
CVSS 7.5 HIGH
Reported by apache · Published September 10, 2026
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Artemis | 2.50.0 |
| Apache Software Foundation | Apache ActiveMQ Artemis | 1.0.0 |
| Apache Software Foundation | Apache ActiveMQ Artemis | 1.0.0 |
| Apache Software Foundation | Apache Artemis | 2.50.0 |
Timeline
- Sep 10, 2026 EPSS Score
- Sep 10, 2026 Coalition ESS Score
- Sep 10, 2026 CVE Published
- Sep 10, 2026 CVE Updated
- Sep 11, 2026 EPSS Score
- Sep 11, 2026 Distribution Patch
- Sep 11, 2026 Security Advisory
- Sep 11, 2026 Distribution Patch
- Sep 11, 2026 Security Advisory
- Sep 15, 2026 EPSS Score
- Sep 15, 2026 Distribution Patch
- Sep 15, 2026 Security Advisory
References
- vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/09/10/1 url