Is CVE-2026-66073 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66073 being exploited in the wild.

How severe is CVE-2026-66073?

Informational severity, published 25 September 2026.

Which products and versions are affected?

VMware RabbitMQ 3.13.0–3.13.14, 4.0.0–4.0.19, 4.1.0–4.1.10, 4.2.0–4.2.5.

Is there a fix for CVE-2026-66073?

A patch was published on 2026-04-23: Version 4.2.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66073 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-66073?

Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66073: RabbitMQ atom table exhaustion in management API

CVE-2026-66073 · Severity: info · Published 2026-09-25

RabbitMQ, a messaging broker used to route and queue messages across distributed systems, contains a vulnerability in its management API that allows authenticated users to exhaust system resources by leaking permanent memory objects. An attacker with basic user privileges can crash the entire broker—affecting all users and applications—by sending approximately 900,000 crafted API requests. This results in a complete denial of service where all tenants lose access to messaging services.

Technologies: VMware RabbitMQ. Vendors: VMware.

Quick answers

Is CVE-2026-66073 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66073 being exploited in the wild.
How severe is CVE-2026-66073?: Informational severity, published 25 September 2026.
Which products and versions are affected?: VMware RabbitMQ 3.13.0–3.13.14, 4.0.0–4.0.19, 4.1.0–4.1.10, 4.2.0–4.2.5.
Is there a fix for CVE-2026-66073?: A patch was published on 2026-04-23: Version 4.2.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66073 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-66073?: Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an atom table exhaustion flaw in the management API endpoints (PUT /api/queues, /api/exchanges, /api/bindings) where the node JSON field parameter is passed directly to listtoatom without validation of cluster membership. Each unique node value leaks one permanent atom, and the Erlang VM crashes at the system limit after approximately 900,000 requests. The attack requires management API access (the management tag privilege) on any virtual host and exploits the unpatched getnode/1 function in rabbitmgmtutil.erl.

Affected products

VMware RabbitMQ 3.13.0–3.13.14, 4.0.0–4.0.19, 4.1.0–4.1.10, 4.2.0–4.2.5

Timeline

2026-09-25: disclosed
2026-04-23: patched: Version 4.2.6 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.