Vulnerability-Lookup

CVE-2026-67593 (GCVE-0-2026-67593)

Vulnerability from cvelistv5 – Published: 2026-09-10 04:40 – Updated: 2026-09-10 15:51

Title

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

Summary

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 15:50 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/zlglnsg8s5xv8n56d…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/10/6

Impacted products

3 products

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Artemis	Affected: 2.50.0 , ≤ 2.56.0 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ Artemis	Affected: 1.0.0 , ≤ 2.44.0 (semver)	guessed
Apache Software Foundation	Apache ActiveMQ Artemis	Affected: 2.32.0 , ≤ 2.44.0 (semver)	guessed

Credits

Daniel Birtwhistle krsecurity(kongr) Dilrevx, NSSL, SJTU

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-10T05:11:59.078Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-67593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T15:50:42.737088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:51:10.430Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.artemis:artemis-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.artemis/artemis-openwire-protocol",
          "product": "Apache Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.56.0",
              "status": "affected",
              "version": "2.50.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.artemis:artemis-jakarta-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocol",
          "product": "Apache Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.56.0",
              "status": "affected",
              "version": "2.50.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:artemis-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.activemq/artemis-openwire-protocol",
          "product": "Apache ActiveMQ Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.44.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:artemis-jakarta-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol",
          "product": "Apache ActiveMQ Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.44.0",
              "status": "affected",
              "version": "2.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Birtwhistle"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "krsecurity(kongr)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dilrevx, NSSL, SJTU"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \u003c/p\u003e\u003cp\u003eThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.57.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T04:40:29.793Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-67593",
    "datePublished": "2026-09-10T04:40:29.793Z",
    "dateReserved": "2026-07-29T21:00:39.551Z",
    "dateUpdated": "2026-09-10T15:51:10.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-67593",
      "date": "2026-09-21",
      "epss": "0.00557",
      "percentile": "0.45008"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.artemis:artemis-openwire-protocol",
                "packageURL": "pkg:maven/org.apache.artemis/artemis-openwire-protocol",
                "product": "Apache Artemis",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "2.56.0",
                    "status": "affected",
                    "version": "2.50.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.artemis:artemis-jakarta-openwire-protocol",
                "packageURL": "pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocol",
                "product": "Apache Artemis",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "2.56.0",
                    "status": "affected",
                    "version": "2.50.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:artemis-openwire-protocol",
                "packageURL": "pkg:maven/org.apache.activemq/artemis-openwire-protocol",
                "product": "Apache ActiveMQ Artemis",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "2.44.0",
                    "status": "affected",
                    "version": "1.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "org.apache.activemq:artemis-jakarta-openwire-protocol",
                "packageURL": "pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol",
                "product": "Apache ActiveMQ Artemis",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThanOrEqual": "2.44.0",
                    "status": "affected",
                    "version": "2.32.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6E3F972-3247-4504-AFD9-833891228040",
                    "versionEndExcluding": "2.44.0",
                    "versionStartIncluding": "1.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A41D89AC-2573-4270-9C7C-21D85E1096FE",
                    "versionEndExcluding": "2.57.0",
                    "versionStartIncluding": "2.50.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue."
          }
        ],
        "id": "CVE-2026-67593",
        "lastModified": "2026-09-16T01:10:17.700",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-67593",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T15:50:42.737088Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-10T05:17:01.560",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "security@apache.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-11T08:34:50+00:00",
      "cve": "CVE-2026-67593",
      "id": "CVE-2026-67593",
      "initial_release_date": "2026-09-10T05:32:43.600000+00:00",
      "product_status:fixed": "2",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67593.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-09-10T05:11:59.078Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 9.1,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-67593",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-10T15:50:42.737088Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-10T15:51:06.967Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.artemis:artemis-openwire-protocol",
              "packageURL": "pkg:maven/org.apache.artemis/artemis-openwire-protocol",
              "product": "Apache Artemis",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "2.56.0",
                  "status": "affected",
                  "version": "2.50.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.artemis:artemis-jakarta-openwire-protocol",
              "packageURL": "pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocol",
              "product": "Apache Artemis",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "2.56.0",
                  "status": "affected",
                  "version": "2.50.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:artemis-openwire-protocol",
              "packageURL": "pkg:maven/org.apache.activemq/artemis-openwire-protocol",
              "product": "Apache ActiveMQ Artemis",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "2.44.0",
                  "status": "affected",
                  "version": "1.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://repo.maven.apache.org/maven2",
              "defaultStatus": "unaffected",
              "packageName": "org.apache.activemq:artemis-jakarta-openwire-protocol",
              "packageURL": "pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol",
              "product": "Apache ActiveMQ Artemis",
              "vendor": "Apache Software Foundation",
              "versions": [
                {
                  "lessThanOrEqual": "2.44.0",
                  "status": "affected",
                  "version": "2.32.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Daniel Birtwhistle"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "krsecurity(kongr)"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Dilrevx, NSSL, SJTU"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \u003c/p\u003e\u003cp\u003eThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.57.0, which fixes the issue.\u003c/p\u003e"
                }
              ],
              "value": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "text": "important"
                },
                "type": "Textual description of severity"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306 Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-10T04:40:29.793Z",
            "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            "shortName": "apache"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "assignerShortName": "apache",
        "cveId": "CVE-2026-67593",
        "datePublished": "2026-09-10T04:40:29.793Z",
        "dateReserved": "2026-07-29T21:00:39.551Z",
        "dateUpdated": "2026-09-10T15:51:10.430Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-67593

Vulnerability from fkie_nvd - Published: 2026-09-10 05:17 - Updated: 2026-09-16 01:10

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs	Mailing List, Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/09/10/6	Mailing List, Third Party Advisory

Impacted products

	Vendor	Product	Version
	apache	artemis	*
	apache	artemis	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.artemis:artemis-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.artemis/artemis-openwire-protocol",
          "product": "Apache Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.56.0",
              "status": "affected",
              "version": "2.50.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.artemis:artemis-jakarta-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.artemis/artemis-jakarta-openwire-protocol",
          "product": "Apache Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.56.0",
              "status": "affected",
              "version": "2.50.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:artemis-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.activemq/artemis-openwire-protocol",
          "product": "Apache ActiveMQ Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.44.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.activemq:artemis-jakarta-openwire-protocol",
          "packageURL": "pkg:maven/org.apache.activemq/artemis-jakarta-openwire-protocol",
          "product": "Apache ActiveMQ Artemis",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.44.0",
              "status": "affected",
              "version": "2.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6E3F972-3247-4504-AFD9-833891228040",
              "versionEndExcluding": "2.44.0",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A41D89AC-2573-4270-9C7C-21D85E1096FE",
              "versionEndExcluding": "2.57.0",
              "versionStartIncluding": "2.50.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue."
    }
  ],
  "id": "CVE-2026-67593",
  "lastModified": "2026-09-16T01:10:17.700",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-67593",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-10T15:50:42.737088Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-10T05:17:01.560",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-59P6-J354-3GPJ

Vulnerability from github – Published: 2026-09-10 06:31 – Updated: 2026-09-10 18:31

Details

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-67593"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T05:17:01Z",
    "severity": "CRITICAL"
  },
  "details": "A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. \n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue.",
  "id": "GHSA-59p6-j354-3gpj",
  "modified": "2026-09-10T18:31:39Z",
  "published": "2026-09-10T06:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67593"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/zlglnsg8s5xv8n56d15dm5mf00h2d8xs"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/10/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

RHSA-2026:66488

Vulnerability from csaf_redhat - Published: 2026-09-10 16:34 - Updated: 2026-09-21 11:48

Summary

Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update

Severity

Important

Scope

67 vulnerabilities in this advisory, including CVE-2026-67593.

CVE-2026-67593

An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled (default). The processRemoveSubscription() method executes pre-authentication with no authorization check, and uses the internal destroyQueue(SimpleString) overload that skips security entirely. Default queues DLQ and ExpiryQueue are trivially targetable. This is unfixed in all Artemis versions through 2.55.0.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2026:66488

Open the full advisory

RHSA-2026:66545

Vulnerability from csaf_redhat - Published: 2026-09-10 23:22 - Updated: 2026-09-21 11:48

Summary

Red Hat Security Advisory: Red Hat AMQ Broker 7.13.6 release and security update

Severity

Important

Scope

59 vulnerabilities in this advisory, including CVE-2026-67593.

CVE-2026-67593

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2026:66545

Open the full advisory

WID-SEC-W-2026-3289

Vulnerability from csaf_certbund - Published: 2026-09-09 22:00 - Updated: 2026-09-10 22:00

Summary

Apache ActiveMQ Artemis: Mehrere Schwachstellen

Severity

Hoch

Scope

7 vulnerabilities in this advisory, including CVE-2026-67593.

CVE-2026-67593

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-67593 (GCVE-0-2026-67593)

FKIE_CVE-2026-67593

GHSA-59P6-J354-3GPJ

RHSA-2026:66488

RHSA-2026:66545

WID-SEC-W-2026-3289

Tags

Sightings

Nomenclature

Related by attack behaviour