Unauthenticated Session Hijacking in Apache Artemis and ActiveMQ
CVE-2026-57967

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Artemis; Apache ActiveMQ Artemis
Vendor: CVE Published:; 10 September 2026

What is CVE-2026-57967?

A vulnerability exists in Apache Artemis and ActiveMQ that allows an unauthenticated remote attacker to exploit the CORE protocol SESSION_REATTACH packet. This exploitation can potentially lead to unauthorized access by seizing control of an ongoing authenticated session. Users are urged to upgrade to version 2.57.0 to mitigate this risk.

Affected Version(s)

Apache ActiveMQ Artemis 1.0.0 <= 2.44.0

Apache Artemis 2.50.0 <= 2.56.0

References

https://lists.apache.org/thread/fxfjqrdsnksw5f17zs3yqo864...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 10, 2026
Vulnerability Reserved
Jun 26, 2026

Credit

Domenico Francesco Bruscino

Fedrick Sequeira

CVE-2026-57967 Data

JSON