« Volver al listado

CVE-2026-27446

Estado: ModificadaCrítica (9.3)—

Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:

- incoming Core protocol connections from untrusted sources to the broker

- outgoing Core protocol connections from the broker to untrusted targets

Leer descripción completaMostrar menos

This issue affects:

- Apache Artemis from 2.50.0 through 2.51.0

- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.

Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.

The issue can be mitigated by one of the following:

- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.

- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.

- Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at  https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de autenticación faltante (CWE-306) en Apache Artemis accesible remotamente sin privilegios previos. Permite inyección y exfiltración de mensajes mediante conexión a broker rogue.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

Apache — Artemis

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27446",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27446",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-04T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@apache.org",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Artemis",
          "versions": [
            {
              "status": "affected",
              "version": "2.50.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.51.0"
            }
          ],
          "packageName": "org.apache.artemis:artemis-server",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache ActiveMQ Artemis",
          "versions": [
            {
              "status": "affected",
              "version": "2.11.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.44.0"
            }
          ],
          "packageName": "org.apache.activemq:artemis-server",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:amq_broker:7.12"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AMQ Broker 7.12.6",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_broker:7.13"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AMQ Broker 7.13.4",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:apache_camel_spring_boot:4.18"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.16.0-22.redhat_00057.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-activemq-artemis",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-glassfish-jsf",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-ironjacamar",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-annotations",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-databind",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-jaxrs-providers",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-modules-base",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-modules-java8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jboss-remoting",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jboss-server-migration",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-netty",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-netty-transport-native-epoll",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-picketlink-bindings",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-picketlink-federation",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.16.0-22.redhat_00057.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-activemq-artemis",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-glassfish-jsf",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-ironjacamar",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-annotations",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-databind",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-jaxrs-providers",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-modules-base",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-modules-java8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jboss-remoting",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jboss-server-migration",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-netty",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-netty-transport-native-epoll",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-picketlink-bindings",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-picketlink-federation",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.16.0-22.redhat_00057.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-activemq-artemis",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-glassfish-jsf",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-ironjacamar",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-annotations",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-core",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-databind",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-jaxrs-providers",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-modules-base",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.18.8-1.redhat_00003.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jackson-modules-java8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jboss-remoting",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-jboss-server-migration",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-netty",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-netty-transport-native-epoll",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-picketlink-bindings",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-picketlink-federation",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-undertow",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap7-wildfly",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform::el7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1.7.GA",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.40.0.redhat-00015",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "org.apache.activemq/artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.40.0-6.redhat_00012.1.el8eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-activemq-artemis",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:2.40.0-6.redhat_00012.1.el9eap",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "eap8-activemq-artemis",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:amq_clients:2023"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat AMQ Clients",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:optaplanner:::el6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of OptaPlanner 8",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Dev Spaces",
          "packageName": "devspaces/dashboard-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Dev Spaces",
          "packageName": "devspaces/devspaces-operator-bundle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Process Automation 7",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Satellite 6",
          "packageName": "candlepin",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Satellite 6",
          "packageName": "satellite:el8/candlepin",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Single Sign-On 7",
          "packageName": "artemis-server",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "Opcenter RDnL",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-03-04T09:15:56.837",
  "references": [
    {
      "url": "https://lists.apache.org/thread/jwpsdc8tdxotm98od8n8n30fqlzoc8gg",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/03/4",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/03/04/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:17668",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:18054",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:18055",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:18059",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:3955",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:3957",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53644",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53645",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:53646",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-27446",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444320",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-085541.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27446.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both:\n\n- incoming Core protocol connections from untrusted sources to the broker\n\n- outgoing Core protocol connections from the broker to untrusted targets\n\nThis issue affects:\n\n- Apache Artemis from 2.50.0 through 2.51.0\n\n- Apache ActiveMQ Artemis from 2.11.0 through 2.44.0.\n\nUsers are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.\n\nThe issue can be mitigated by one of the following:\n\n- Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the \"artemis\" acceptor listening on port 61616. See the \"protocols\" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core.\n\n- Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability.\n\n- Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at  https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html ."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Autenticación Faltante para Función Crítica (CWE-306) en Apache Artemis, Apache ActiveMQ Artemis. Un atacante remoto no autenticado puede usar el protocolo Core para forzar a un broker objetivo a establecer una conexión de federación Core saliente con un broker malicioso controlado por el atacante. Esto podría resultar potencialmente en la inyección de mensajes en cualquier cola y/o la exfiltración de mensajes de cualquier cola a través del broker malicioso. Esto afecta a entornos que permiten ambos:\n\n- conexiones de protocolo Core entrantes desde fuentes no confiables al broker\n\n- conexiones de protocolo Core salientes desde el broker a objetivos no confiables\n\nEste problema afecta a:\n\n- Apache Artemis desde 2.50.0 hasta 2.51.0\n\n- Apache ActiveMQ Artemis desde 2.11.0 hasta 2.44.0.\n\nSe recomienda a los usuarios actualizar a la versión 2.52.0 de Apache Artemis, que corrige el problema.\n\nEl problema puede mitigarse mediante cualquiera de las siguientes opciones:\n\n- Eliminar el soporte del protocolo Core de cualquier aceptor que reciba conexiones de fuentes no confiables. Las conexiones de protocolo Core entrantes son compatibles por defecto a través del aceptor 'artemis' que escucha en el puerto 61616. Consulte el parámetro URL 'protocols' configurado para el aceptor. Una URL de aceptor sin este parámetro soporta todos los protocolos por defecto, incluyendo Core.\n\n- Usar SSL bidireccional (es decir, autenticación basada en certificados) para forzar a cada cliente a presentar el certificado SSL adecuado al establecer una conexión antes de que se intente cualquier handshake de protocolo de mensajes. Esto evitará la explotación no autenticada de esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-09-18T13:17:45.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB268C2F-5143-4F38-A799-1E2AA9D00875",
              "versionEndIncluding": "2.44.0",
              "versionStartIncluding": "2.11.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:artemis:2.50.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AF62B6D-CD60-43D0-9740-AC011CC1FBFF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}