Technology · Apache
Apache ActiveMQ Artemis vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 16 vulnerabilities in Apache ActiveMQ Artemis: 0 in the last 7 days and 8 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-101292, was published on 28 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.
- Last 7 days
- 0
- Last 90 days
- 8
- Critical, all time
- 4
- Exploited in the wild
- 0
About Apache ActiveMQ Artemis
Apache ActiveMQ Artemis is a message broker that supports multiple protocols for asynchronous messaging.
Latest Apache ActiveMQ Artemis vulnerabilities
- CVE-2026-101292: Apache ActiveMQ Artemis unsafe reflection in federationhighCVSS 8.2
- CVE-2026-75880: Apache ActiveMQ Artemis denial of service via crafted wildcard selectormediumCVSS 6.5EPSS 0.7%
- CVE-2026-67593: Apache Artemis Openwire RemoveSubscriptionInfo unauthenticated queue deletioncriticalCVSS 9.1EPSS 0.9%
- CVE-2026-57967: Apache Artemis CORE protocol session reattach authentication bypasscriticalCVSS 9.8EPSS 1.1%
- CVE-2026-57822: Apache Artemis Java deserialization denial of service in message managementmediumCVSS 6.5EPSS 0.7%
- CVE-2026-49364: Apache Artemis credential exposure during cluster handshakecriticalCVSS 9.1EPSS 0.6%
- CVE-2026-49363: Apache Artemis cluster topology disclosure via SUBSCRIBE_TOPOLOGYhighCVSS 7.5EPSS 0.8%
- CVE-2026-49362: Apache Artemis unauthenticated queue creation via CORE protocolhighCVSS 7.5EPSS 0.8%
- CVE-2026-40914: Apache Artemis authorization bypass in STOMP protocolmediumCVSS 4.3EPSS 0.6%
- CVE-2026-32642: Apache ActiveMQ Artemis incorrect authorization in OpenWire protocolmediumCVSS 4.3EPSS 0.6%
- CVE-2026-27446: Apache ActiveMQ Artemis authentication bypass in Core protocolcriticalCVSS 9.8EPSS 1.1%
- CVE-2022-35278: Apache ActiveMQ Artemis HTML injection in Web ConsolemediumCVSS 6.1EPSS 1.7%
- CVE-2020-10727: Apache ActiveMQ Artemis plaintext password storage in resetUsers operationmediumCVSS 5.5EPSS 0.7%
- CVE-2020-13932: Apache ActiveMQ Artemis XSS in admin console diagram pluginmediumCVSS 6.1EPSS 4.3%
- CVE-2022-23913: Apache ActiveMQ Artemis DoS via uncontrolled memory consumptionhighCVSS 7.5EPSS 2.7%
- CVE-2021-26118: Apache ActiveMQ Artemis improper access control in OpenWire protocolhighCVSS 7.5EPSS 3.9%
Most severe Apache ActiveMQ Artemis vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-27446: Apache ActiveMQ Artemis authentication bypass in Core protocolcriticalCVSS 9.8EPSS 1.1%
- CVE-2026-57967: Apache Artemis CORE protocol session reattach authentication bypasscriticalCVSS 9.8EPSS 1.1%
- CVE-2026-67593: Apache Artemis Openwire RemoveSubscriptionInfo unauthenticated queue deletioncriticalCVSS 9.1EPSS 0.9%
- CVE-2026-49364: Apache Artemis credential exposure during cluster handshakecriticalCVSS 9.1EPSS 0.6%
- CVE-2026-101292: Apache ActiveMQ Artemis unsafe reflection in federationhighCVSS 8.2
- CVE-2021-26118: Apache ActiveMQ Artemis improper access control in OpenWire protocolhighCVSS 7.5EPSS 3.9%
- CVE-2022-23913: Apache ActiveMQ Artemis DoS via uncontrolled memory consumptionhighCVSS 7.5EPSS 2.7%
- CVE-2026-49362: Apache Artemis unauthenticated queue creation via CORE protocolhighCVSS 7.5EPSS 0.8%
- CVE-2026-49363: Apache Artemis cluster topology disclosure via SUBSCRIBE_TOPOLOGYhighCVSS 7.5EPSS 0.8%
- CVE-2026-57822: Apache Artemis Java deserialization denial of service in message managementmediumCVSS 6.5EPSS 0.7%
Vulnerabilities per week
Nothing in the last four weeks, down from 1 vulnerability in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 7 | 3 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache ActiveMQ Artemis vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/activemq-artemis)<a href="https://junglewise.ai/threats/technologies/activemq-artemis"><img src="https://junglewise.ai/threats/technologies/activemq-artemis/badge.svg" alt="Apache ActiveMQ Artemis vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/activemq-artemis.json, and this page as text at https://junglewise.ai/threats/technologies/activemq-artemis.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache ActiveMQ Artemis vulnerabilities", https://junglewise.ai/threats/technologies/activemq-artemis, 12 November 2026.