FIVE high‑severity flaws in Apache Artemis, encompassing the Core and protocol handling layers, require immediate attention. The vulnerabilities, linked to ActiveMQ Artemis, could enable unauthorised session theft, credential exposure and denial of service. The advisory calls for upgrading to version 2.57.0 to secure affected message brokers.
The article stresses these issues affect a broad range of deployments, with Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 implicated. Exact installation counts are not verified, but the software is widely deployed in enterprise environments.
The faults arise from missing authentication checks and improper protocol handling. Notably, CVE-2026-67593 describes an Openwire RemoveSubscriptionInfo command that can delete a queue before authentication, while CVE-2026-57967 targets the CORE protocol, permitting an unauthenticated remote attacker to craft a CORE SESSION_REATTACH packet to steal an existing session and take over an authenticated session.
Additional issues include CVE-2026-49362, which allows creation of arbitrary durable queues without authentication, and CVE-2026-49364, which exposes cluster administrative credentials during the initial handshake. CVE-2026-57822 involves Java deserialization, where authenticated users triggering specific management requests can cause excessive processing and a denial of service. The piece notes that, as of its publication, researchers have not confirmed active exploitation in the wild, and no public PoCs exist. Administrators are advised to apply the official patch promptly by upgrading to 2.57.0.