What’s Vulnerable › Products

Apache Software Foundation Apache ActiveMQ Artemis vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your Apache Software Foundation Apache ActiveMQ Artemis version is affected

Latest Apache Software Foundation Apache ActiveMQ Artemis vulnerabilities

• CVE-2026-75880 — Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service (CVSS 6.5)
• CVE-2026-67593 — Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion (CVSS 9.1)
• CVE-2026-57967 — Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment (CVSS 9.8)
• CVE-2026-57822 — Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service (CVSS 6.5)
• CVE-2026-49364 — Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers (CVSS 9.1)
• CVE-2026-49363 — Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription (CVSS 7.5)
• CVE-2026-49362 — Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation (CVSS 7.5)
• CVE-2026-40914 — Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission (CVSS 4.3)
• CVE-2026-32642 — Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission (CVSS 4.3)
• CVE-2026-27446 — Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation (CVSS 9.8)
• CVE-2025-27391 — Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log (CVSS 6.5)
• CVE-2025-27427 — Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission (CVSS 4.3)
• CVE-2023-50780 — Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans (CVSS 8.8)
• CVE-2021-4040 — (CVSS 5.3)
• CVE-2022-35278 — HTML Injection in ActiveMQ Artemis Web Console (CVSS 6.1)
• CVE-2022-23913 — Apache ActiveMQ Artemis DoS (CVSS 7.5)
• CVE-2021-26118 — Flaw in ActiveMQ Artemis OpenWire support (CVSS 7.5)
• CVE-2021-26117 — ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind (CVSS 7.5)
• CVE-2020-13932 — (CVSS 6.1)
• CVE-2020-10727 — (CVSS 5.5)
• CVE-2017-12174 — (CVSS 7.5)
• CVE-2016-4978 — (CVSS 7.2)