LiveActive security incident?Get immediate response
CVE Record

CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at  https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

CriticalCVSS 9.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

An unauthenticated attacker could make a vulnerable message broker connect to a rogue broker, potentially exposing or inserting messages across any queue. Exploitation requires untrusted access to the broker’s Core protocol and permission for the broker to make outbound Core connections to untrusted destinations.

Executive priority

Treat as an urgent remediation for brokers meeting both exposure conditions, particularly where queues contain sensitive or operational messages. Prioritize rapid network containment, then upgrade. Brokers lacking either untrusted inbound Core access or untrusted outbound Core connectivity have materially reduced exposure but should still be inventoried and remediated.

Technical view

CVE-2026-27446 is a CWE-306 authentication bypass in Core downstream federation. A remote, unauthenticated actor can send a federation connect request that causes the target broker to establish an outbound connection to an attacker-controlled broker, potentially enabling queue-wide message injection or exfiltration. CVSS 4.0 is 9.3.

Likely exposure

Affected versions are Apache Artemis 2.50.0–2.51.0 and Apache ActiveMQ Artemis 2.11.0–2.44.0. Exposure requires both inbound Core protocol access from untrusted sources and outbound Core connectivity to untrusted targets. The default artemis acceptor commonly enables Core on port 61616 unless protocols are restricted.

Exploitation context

The supplied sources do not establish active exploitation, and the CVE is not identified as being in KEV. Nevertheless, exploitation is remote, requires no privileges or user interaction, and has low complexity when both network conditions exist. Potential impact includes high confidentiality and integrity loss involving broker messages.

Researcher notes

The critical boundary is the combination of inbound and outbound Core reachability, not version alone. Review acceptor protocol parameters carefully: omitting the protocols parameter enables all protocols by default, including Core. The advisory identifies downstream federation connect packets as type integer -16 or byte 0xfffffff0. No public exploitation evidence is established in the supplied bundle.

Mitigation direction

  • Upgrade affected deployments to Apache Artemis 2.52.0, as recommended by Apache.
  • Remove Core support from acceptors reachable by untrusted sources.
  • Require two-way SSL so clients authenticate with approved certificates before protocol negotiation.
  • Restrict broker outbound Core connectivity to trusted destinations.
  • Alternatively, deploy a Core interceptor denying downstream federation connect packets.

Validation and detection

  • Inventory Artemis and ActiveMQ Artemis versions across all broker deployments.
  • Review acceptor configurations for Core support, especially listeners on port 61616.
  • Confirm whether untrusted networks can reach any Core-enabled acceptor.
  • Test whether brokers can establish outbound Core connections to untrusted destinations.
  • Verify two-way SSL requires a valid client certificate before protocol negotiation.
  • Confirm interceptor controls reject Core downstream federation connect packets, if used.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-306: Credential and account abuse lookup

Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-27446 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.3 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
4ADP providers
14Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L——apache
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2redhat-SADP

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-27446Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. ADP timelineredhat-SADP

    Reported to Red Hat.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container
redhat-SADPorg.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
other:Red Hat severity ratingcvssV3_1
  • 2026-03-04T07:02:26.064Z: Reported to Red Hat.
  • 2026-03-04T06:06:00.000Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache Artemisorg.apache.artemis:artemis-server, 2.50.0unaffected
Apache Software FoundationApache ActiveMQ Artemisorg.apache.activemq:artemis-server, 2.11.0unaffected
Weakness

CWE details

CWE-306

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-306 · source CWE mapping

Missing Authentication for Critical Function

Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs