CVE-2026-49362
Last modified
CVE-2026-49362 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Artemis | >= 2.50.0, <= 2.56.0 |
| Apache Software Foundation | Apache ActiveMQ Artemis | >= 1.0.0, <= 2.44.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-49362?
How severe is CVE-2026-49362?
How do I fix CVE-2026-49362?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49357Line Desktop MCP is a project that, while unaffiliated with …8.8
- CVE-2026-49358PhpWeasyPrint is a PHP library allowing PDF generation from …3
- CVE-2026-49359PhpWeasyPrint is a PHP library allowing PDF generation from …6.5
- CVE-2026-4936IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual T…6.2
- CVE-2026-49360Recce is a data-validation toolkit for enhanced dbt (data bu…7.8
- CVE-2026-49361Apache Fluss versions prior to 0.9.1 configure the Netty Len…7.5
- CVE-2026-49363An unauthenticated remote attacker connecting with the CORE …7.5
- CVE-2026-49364An unauthenticated network-adjacent attacker can leverage di…9.1
- CVE-2026-49365Generation of Error Message Containing Sensitive Information…5.3
- CVE-2026-49366In JetBrains IntelliJ IDEA before 2026.1.1 command injection…7.8
- CVE-2026-49367In JetBrains IntelliJ IDEA before 2026.1.1 command execution…8.8
- CVE-2026-49368In JetBrains YouTrack before 2026.1.13162 stored XSS in proj…5.4
Are you affected by CVE-2026-49362?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST