Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-49363— Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

Quick assessment

Affected

Apache Software Foundation Apache Artemis

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Artemis是美国Apache基金会开源的一款支持多种消息协议的高性能消息代理软件。 Apache Artemis 2.50.0版本至2.56.0版本和Apache ActiveMQ Artemis 1.0.0版本至2.44.0版本存在授权问题漏洞，该漏洞源于未经身份验证的远程攻击者可通过CORE协议在身份验证前发送SUBSCRIBE_TOPOLOGY请求，可能导致集群节点详细信息泄露。

AI Predicted 5.3 Difficulty: Easy EPSS 0.80% · P57 Updated Sep 11, 2026

Possible ATT&CK Techniques 3 AI

T1529 · System Shutdown/Reboot T1120 · Peripheral Device Discovery T1046 · Network Service Discovery

Affected Version Matrix 2

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache ActiveMQ Artemis	`1.0.0≤ 2.44.0`	affected
Apache Software Foundation	Apache Artemis	`2.50.0≤ 2.56.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49363

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

Source: CVE Program / CVE List V5

Vulnerability Description

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Vulnerability Title

Apache Artemis 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Artemis	2.50.0 ~ 2.56.0	-
Apache Software Foundation	Apache ActiveMQ Artemis	1.0.0 ~ 2.44.0	-

II. Public POCs for CVE-2026-49363

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-49363

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-49363 (1)

🔗 CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription-Apache Mail Archives vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-49363

Same Patch Batch · Apache Software Foundation · 2026-09-10 · 11 CVEs total

CVE-2026-80354		Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secr
CVE-2026-80351		Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
CVE-2026-80352		Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author appl
CVE-2026-84939		Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path trave
CVE-2026-49362		Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler A
CVE-2026-49364		Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Auth
CVE-2026-57822		Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserializatio
CVE-2026-57967		Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session r
CVE-2026-67593		Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-auth
CVE-2026-75880		Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to

IV. Related Vulnerabilities

Same product: Apache Artemis

Same vendor: Apache Software Foundation

Same weakness: CWE-306