VDB

CVE-2026-49364

CVE-2026-49364 PUBLISHED CVSS 9.1 CRITICAL

Reported by apache · Published September 10, 2026

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Risk Scores

CVSS 3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Apache Software FoundationApache Artemis2.50.0
Apache Software FoundationApache Artemis2.50.0
Apache Software FoundationApache ActiveMQ Artemis1.0.0
Apache Software FoundationApache ActiveMQ Artemis1.0.0
Apache Software FoundationApache Artemis2.50.0
Apache Software FoundationApache Artemis2.50.0
Apache Software FoundationApache ActiveMQ Artemis1.0.0
Apache Software FoundationApache ActiveMQ Artemis1.0.0

Timeline

  • Sep 10, 2026 EPSS Score
  • Sep 10, 2026 Coalition ESS Score
  • Sep 10, 2026 CVE Published
  • Sep 10, 2026 CVE Updated
  • Sep 11, 2026 EPSS Score
  • Sep 11, 2026 Distribution Patch
  • Sep 11, 2026 Security Advisory
  • Sep 11, 2026 Distribution Patch
  • Sep 11, 2026 Security Advisory
  • Sep 12, 2026 EPSS Score
  • Sep 15, 2026 Distribution Patch
  • Sep 15, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›