CVE-2026-27446Disclosure(apache / artemis)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apache artemis systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

apache CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

artemis

Threat summary

Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 7 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 4d ago at 3 mentions (2026-03-04); latest day: 1
9 total mentions across 5 days

Affected systems

Vendors

apache

Products

artemis

1 version affected across 1 product

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Disclosure

555.6%

Patch

333.3%

General

111.1%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-04	3	Disclosure2General1
2026-03-05	3	Disclosure1Patch2
2026-03-07	1	Patch1
2026-03-08	1	Disclosure1
2026-03-13	1	Disclosure1

Full discourse9 posts

Open Source Security mailing list@oss_security215d
Disclosure
CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation https://www.openwall.com/lists/oss-security/2026/03/03/4 CVE-2025-66168: Apache ActiveMQ, All Module, MQTT Module: MQTT control packet remaining length field is not properly validated https://www.openwall.com/lists/oss-security/2026/03/03/5
Post summary
The text announces two new CVE disclosures affecting Apache Artemis and Apache ActiveMQ, detailing an authentication bypass and a missing packet validation, but it offers no PoC, exploit, active exploitation evidence, or patch information.
00040441
4.4K followersView on X
Misbar | مسبار@MisbarSec216d
Patch
📌 ثغرة (Integer Overflow) في Apache ActiveMQ تُعرض MQTT لهجمات (DoS) كشفت مؤسسة برمجيات أباتشي عن ثغرة أمنية حرجة من نوع (Integer Overflow) في موصل MQTT الخاص بـ Apache ActiveMQ، والمُتتبعة ضمن CVE-2026-27446. تستغل هذه الثغرة المعالجة الخاطئة للبيانات، مما يسمح للمهاجمين باستنزاف موارد النظام وتعطيل خدمة MQTT. يؤدي استغلال هذه الثغرة إلى هجمات (DoS) ضد الأنظمة المتأثرة. أصدرت المؤسسة تحديثًا أمنيًا لمعالجة هذه الثغرة، ويُنصح بتطبيق التحديثات الأمنية فورًا للتخفيف من المخاطر. 🔗 للمزيد: https://securityonline.info/integer-overflow-flaw-in-apache-activemq-exposes-mqtt-brokers-to-dos/
Post summary
The article reports a critical Integer Overflow CVE in Apache ActiveMQ MQTT that allows DoS attacks and announces a vendor patch, with no evidence of PoC or active exploitation.
00030124
62 followersView on X
CCB Alert@CCBalert218d
Patch
Warning: Critical vulnerability in #Apache Artemis and Apache ActiveMQ Artemis. #CVE-2026-27446 CVSS: 9.3. Successful exploitation could result in message injection or exfiltration. https://ccb.belgium.be/advisories/warning-authentication-bypass-vulnerability-affecting-apache-artemis-and-apache-active #Patch #Patch #Patch
Post summary
The tweet warns of CVE‑2026‑27446 in Apache Artemis, citing a CVSS score, potential impact, and an implied patch via the advisory link and #Patch tags.
01010212
7.2K followersView on X
CVEarity@CVEarity218d
Disclosure
⚡ New CVE Alert: CVE-2026-27446 📊 Severity: 9.3 🚨 Risk Level: Critical 🧩 Affects: Apache Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-27446 #CVE-2026-27446 #CVE #Critical #Apache #CyberSecurity #InfoSec https://t.co/t4oDXobaoE
Post summary
The tweet announces a new critical CVE-2026-27446 affecting Apache, providing its severity score and linking to the NVD entry, but includes no PoC, exploit, or mitigation details.
0001047
65 followersView on X
transilienceai@transilienceai210d
Disclosure
🚨 Apache Artemis [Critical] Mar 13, 2026 Product Security Advisory Report for Apache Artemis focusing on CVE-2026-27446, a critical authentication bypass vulnerability. Checkout our Threat Intelligence Platform: https://threatintel.transilience.cloud... https://t.co/Rd3qf0tGm9
Post summary
Apache Artemis CVE-2026-27446 is reported as a critical authentication bypass in a product security advisory. No proof of concept, exploit code, or active exploitation details are provided.
0000051
323 followersView on X
PulsePatch.io@pulsepatchio218d
Patch
`Apache ActiveMQ Artemis` is vulnerable to missing authentication for critical functions (CVE-2026-27446). This allows unauthorized access. Update to 2.52.0 or later. #ActiveMQArtemis #CVE #infosec https://www.pulsepatch.io/posts/cve-2026-27446-apache-activemq-artemis-missing-authentication
Post summary
Apache ActiveMQ Artemis CVE‑2026‑27446 is a missing authentication vulnerability that permits unauthorized access; users are urged to upgrade to version 2.52.0 or newer.
0000027
1 followersView on X
Infoflowcloud@infoflowcloud219d
Disclosure
🚨*CVE* CVE-2026-27446 Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core p… https://www.cve.org/CVERecord?id=CVE-2026-27446 ----- Traducción: CVE-2026-27446 Fal… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑27446, a missing authentication vulnerability in Apache Artemis that permits unauthenticated remote attackers to exploit a critical function, but it provides no PoC, exploit, or patch details.
0000033
55 followersView on X
CVE@CVEnew219d
Disclosure
CVE-2026-27446 Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core p… https://www.cve.org/CVERecord?id=CVE-2026-27446
Post summary
The text announces a missing authentication vulnerability in Apache Artemis, noting that unauthenticated remote attackers can exploit it, but provides no PoC, exploit, or patch details.
00000222
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds219d
General
CVE-2026-27446 CVE-2026-27446 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27446 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The text merely references CVE-2026-27446 and provides a link to a vulnerability details page, offering no additional context or technical information.
0000073
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	artemis	-	-	-
App	apache	artemis	2.50.0	-	-

Explore more

Back to dashboard apache CVEs artemis vulnerabilities

What researchers are saying

CVE-2026-27446

Misbar | مسبار[verified]@MisbarSecPatch

The article reports a critical Integer Overflow CVE in Apache ActiveMQ MQTT that allows DoS attacks and announces a vendor patch, with no evidence of PoC or active exploitation.

transilienceai[verified]@transilienceaiDisclosure

Apache Artemis CVE-2026-27446 is reported as a critical authentication bypass in a product security advisory. No proof of concept, exploit code, or active exploitation details are provided.

Open Source Security mailing list@oss_securityDisclosure

The text announces two new CVE disclosures affecting Apache Artemis and Apache ActiveMQ, detailing an authentication bypass and a missing packet validation, but it offers no PoC, exploit, active exploitation evidence, or patch information.

CCB Alert@CCBalertPatch

The tweet warns of CVE‑2026‑27446 in Apache Artemis, citing a CVSS score, potential impact, and an implied patch via the advisory link and #Patch tags.

CVEarity@CVEarityDisclosure

The tweet announces a new critical CVE-2026-27446 affecting Apache, providing its severity score and linking to the NVD entry, but includes no PoC, exploit, or mitigation details.

PulsePatch.io@pulsepatchioPatch

Apache ActiveMQ Artemis CVE‑2026‑27446 is a missing authentication vulnerability that permits unauthorized access; users are urged to upgrade to version 2.52.0 or newer.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑27446, a missing authentication vulnerability in Apache Artemis that permits unauthenticated remote attackers to exploit a critical function, but it provides no PoC, exploit, or patch details.

CVE@CVEnewDisclosure

The text announces a missing authentication vulnerability in Apache Artemis, noting that unauthenticated remote attackers can exploit it, but provides no PoC, exploit, or patch details.