VulnSocial

CVE-2026-57967Disclosure(apache / artemis)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch apache artemis systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

apache CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-306

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • artemis

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-09-10); latest day: 2
  • 5 total mentions across 3 days

Affected systems

Vendors
apache
Products
artemis

Deep dive

Activity timeline5 mentions / 3d
01122Mentions · 2026-09-10: 2Mentions · 2026-09-12: 1Mentions · 2026-10-07: 2PoC Mentioned / Linked · 2026-09-10: 1PoC Mentioned / Linked · 2026-10-07: 1Exploit Tool / Code · 2026-10-07: 1Patch / Workaround · 2026-09-10: 1Patch / Workaround · 2026-09-12: 1Patch / Workaround · 2026-10-07: 1Technical Details · 2026-09-10: 1Technical Details · 2026-09-12: 1Technical Details · 2026-10-07: 209-1009-1210-07
Signal classification3 categories
Disclosure
360.0%
Patch
120.0%
Exploit
120.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-09-102
Disclosure1Patch1
2026-09-121
Disclosure1
2026-10-072
Disclosure1Exploit1
Full discourse5 posts
  • HOL@HashgraphOnline
    Patch

    Anyone who can reach your Artemis message broker can steal a live session, create queues, or delete queues before login. Apache fixed it in Artemis 2.57.0 (CVE-2026-57967 cluster). https://hol.org/blog/cve-2026-57967-apache-artemis-core-session-reattach-openwire-queue-delete https://t.co/jWOiWjTFfj

    Post summary

    The post highlights a session‑manipulation flaw in Apache Artemis (CVE‑2026‑57967) that can be abused by anyone with broker access, notes the vendor’s fix in version 2.57.0, and links to a blog with further details.

    331901.2K
    19.1K followersView on X
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-57967 PT ID: PT-2026-89272 Read on dbugs: https://dbu.gs/vulnerability/PT-2026-89272 Vendor: Apache Software Foundation Products: • Apache Artemis • Apache ActiveMQ Artemis Description: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue. Link: https://github.com/c0dem4sters/cve-2026-57967

    Post summary

    The text announces a PoC/exploit for CVE-2026-57967, links its GitHub repository, and details an unauthenticated session-hijacking vulnerability. It also identifies fixed version 2.57.0 but does not report active exploitation in the wild.

    02041639
    3.7K followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    🪡 Apache ActiveMQ Artemis: CVE-2026-57967 (CVSS 9.8) — unauthenticated attackers can send a crafted CORE protocol SESSION_REATTACH packet to hijack live authenticated sessions. No creds needed. Patch now. #cybersecurity #ciso #cto #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-57967?utm_campaign=x https://t.co/L2TGytSohm

    Post summary

    Apache ActiveMQ Artemis CVE‑2026‑57967 is a high‑severity vulnerability that allows unauthenticated attackers to hijack live sessions; a patch is available now.

    10000150
    890 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Apache ActiveMQ Artemis, Session Hijacking, #CVE-2026-57967 (Critical) -DC-Oct2026-2781 https://dailycve.com/apache-activemq-artemis-session-hijacking-cve-2026-57967-critical-dc-oct2026-2781/

    Post summary

    The text briefly discloses CVE-2026-57967, a critical session-hijacking vulnerability affecting Apache ActiveMQ Artemis. It provides a general article link but mentions no PoC, exploit tooling, active exploitation, or remediation.

    0000033
    241 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    We have just added an important vulnerability affecting Apache ActiveMQ Artemis (CVE-2026-57967) https://vuldb.com/vuln/401920

    Post summary

    The text announces the addition of a new vulnerability (CVE‑2026‑57967) affecting Apache ActiveMQ Artemis, but does not provide technical details, PoC, or exploitation status.

    00000100
    2.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheartemis---

Explore more

Back to dashboardapache CVEsartemis vulnerabilities