Apache Artemis SESSION_REATTACH RCE 2.50.0-2.56.0
CVE-2026-57967 Published on September 10, 2026

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-57967 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.


Products Associated with CVE-2026-57967

Want to know whenever a new CVE is published for Apache Activemq Artemis? stack.watch will email you.

Apache Activemq Artemis
 

Affected Versions

Apache Software Foundation Apache Artemis: Apache Software Foundation Apache ActiveMQ Artemis: