Skip to content
Fencer Vulns
critical 9.1

CVE-2026-49364 json

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

published 2026-09-10 1 mo ago modified 2026-09-16 54 d ago also EUVD-2026-75248

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Patch / fix

  • apache artemis 2.44.0, 2.57.0
  • eap8-jaxb jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-txw2 jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-xsom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-log4j jboss enterprise application platform 8.1 2.25.4-1.redhat_00003.1.el10eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.136-1.Final_redhat_00001.1.el10eap
  • eap8-rngom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-slf4j jboss enterprise application platform 8.1 2.0.18-1.redhat_00001.1.el10eap
  • eap8-neethi jboss enterprise application platform 8.1 3.2.2-1.redhat_00001.1.el10eap

red hat advisories RHSA-2026:70230RHSA-2026:70229RHSA-2026:70228RHSA-2026:67604

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-49364 updated cvss 8.0

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

  • Red Hat JBoss Enterprise Application Platform 7 jgroups, artemis-server, wildfly-messaging-activemq-subsystem Red Hat JBoss Enterprise Application Platform 8 jgroups, artemis-server
    affected: no fix available
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-6.GA_redhat_00005.1.el7eap, eap7-jackson-core 2.18.9-1.redhat_00003.1.el7eap, eap7-jackson-databind 2.18.9-1.redhat_00003.1.el7eap, eap7-activemq-artemis 2.16.0-23.redhat_00058.1.el7eap, eap7-jackson-jaxrs-base 2.18.9-1.redhat_00003.1.el7eap, eap7-wildfly-modules 7.4.25-6.GA_redhat_00005.1.el7eap, +25 more Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.25-6.GA_redhat_00005.1.el8eap, eap7-jackson-core 2.18.9-1.redhat_00003.1.el8eap, eap7-jackson-databind 2.18.9-1.redhat_00003.1.el8eap, eap7-activemq-artemis 2.16.0-23.redhat_00058.1.el8eap, eap7-jackson-jaxrs-base 2.18.9-1.redhat_00003.1.el8eap, eap7-wildfly-modules 7.4.25-6.GA_redhat_00005.1.el8eap, +26 more Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.25-6.GA_redhat_00005.1.el9eap, eap7-jackson-core 2.18.9-1.redhat_00003.1.el9eap, eap7-jackson-databind 2.18.9-1.redhat_00003.1.el9eap, eap7-activemq-artemis 2.16.0-23.redhat_00058.1.el9eap, eap7-jackson-jaxrs-base 2.18.9-1.redhat_00003.1.el9eap, eap7-wildfly-modules 7.4.25-6.GA_redhat_00005.1.el9eap, +26 more
    fixed: vendor fix RHSA-2026:67604
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-jaxb 4.0.7-4.redhat_00001.1.el8eap, eap8-txw2 4.0.7-4.redhat_00001.1.el8eap, eap8-xsom 4.0.7-4.redhat_00001.1.el8eap, eap8-rngom 4.0.7-4.redhat_00001.1.el8eap, eap8-log4j 2.25.4-1.redhat_00003.1.el8eap, eap8-neethi 3.2.2-1.redhat_00001.1.el8eap, +101 more
    fixed: vendor fix RHSA-2026:70228
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-jaxb 4.0.7-4.redhat_00001.1.el9eap, eap8-txw2 4.0.7-4.redhat_00001.1.el9eap, eap8-xsom 4.0.7-4.redhat_00001.1.el9eap, eap8-rngom 4.0.7-4.redhat_00001.1.el9eap, eap8-log4j 2.25.4-1.redhat_00003.1.el9eap, eap8-neethi 3.2.2-1.redhat_00001.1.el9eap, +101 more
    fixed: vendor fix RHSA-2026:70229
  • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-jaxb 4.0.7-4.redhat_00001.1.el10eap, eap8-txw2 4.0.7-4.redhat_00001.1.el10eap, eap8-xsom 4.0.7-4.redhat_00001.1.el10eap, eap8-rngom 4.0.7-4.redhat_00001.1.el10eap, eap8-log4j 2.25.4-1.redhat_00003.1.el10eap, eap8-neethi 3.2.2-1.redhat_00001.1.el10eap, +100 more
    fixed: vendor fix RHSA-2026:70230
  • Red Hat JBoss Enterprise Application Platform 7.4.25 artemis-server 2.16.0.redhat-00057
    fixed: vendor fix RHSA-2026:67603
show 5 more
  • Red Hat JBoss Enterprise Application Platform 8.1.8.GA artemis-server 2.40.0.redhat-00024
    fixed: vendor fix RHSA-2026:70277
  • Red Hat build of Apache Camel 4 for Quarkus 3 jgroups
    not affected: component not present
  • Red Hat build of Apache Camel for Spring Boot 4 jgroups, artemis-server
    not affected: vulnerable code not present
  • Red Hat Build of Keycloak jgroups
    not affected: component not present
  • Red Hat JBoss Enterprise Application Platform 7.4.25 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1552 more Red Hat JBoss Enterprise Application Platform 8.1.8.GA pom.xml, aesh 2.4, c3 0.6.4, d3 7.4.3, he 1.2.0, lr 1.4.2, +1868 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
1 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Apache Software Foundation Apache Artemis
  • Apache Software Foundation Apache ActiveMQ Artemis

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.