Highest advisory severityCritical 2 vendors · 2 advisories

CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-27446 key facts

CISA KEV: Not listed (catalog checked Nov 10, 2026)
Highest advisory severity: Critical
CVSS base score: 9.3 (Apache), 9.1 (Red Hat)
Weakness: CWE-306
Fixed releases: Apache: 2.52.0
Red Hat: RHSA-2026:3955
Vendor advisories: 2 from Apache, Red Hat
VulniPulse record: Published Mar 4, 2026 · Updated Sep 18, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-27446; bulletin-wide values are not repeated here.

Is CVE-2026-27446 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-27446 is not in the CISA KEV catalog (checked Nov 10, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-27446?

Upgrade to a fixed release named by the vendor:

Apache: 2.52.0
Red Hat: RHSA-2026:3955

Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. (Apache)
The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. (Apache)
Update the affected package(s) to the fixed version shipped in RHSA-2026:3955 (`sudo dnf update` / `yum update`). (Red Hat)

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Vendor advisory comparison

Apache

1 advisory

Advisory severityCritical9.3
Critical [CVE-2026-27446] Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
CVE-2026-27446Source published Mar 4, 2026Source updated Sep 18, 2026
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker This issue affects: Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to…
Affected products in this advisory
Apache Artemis
Apache ActiveMQ Artemis
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
4 more entries in the full advisory.
Source-reported affected versions
Apache Artemis 2.50.0 through 2.51.0
Apache ActiveMQ Artemis 2.11.0 through 2.44.0
Source-reported fixed versions
2.52.0
Mitigation guidance
Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources.
This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets.
Full advisory and evidence Open source bulletin

Red Hat

1 advisory

Advisory severityCritical9.1
Critical [CVE-2026-27446] org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
CVE-2026-27446Source published Mar 4, 2026
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication. Red Hat rates this important (CVSS 9.1). Weakness: CWE-306. Affected package(s): eap8-activemq-artemis, artemis-server. Resolved in Red Hat advisory RHSA-2026:3955 — update the affected packages (`sudo dnf update`).
Affected products in this advisory
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
Red Hat build of OptaPlanner 8
Red Hat Fuse 7
6 more entries in the full advisory.
Source-reported affected versions
eap8-activemq-artemis-0:2.40.0-6.redhat_00012.1.el8eap
eap8-activemq-artemis-0:2.40.0-6.redhat_00012.1.el9eap
artemis-server
Source-reported fixed versions
RHSA-2026:3955
Mitigation guidance
Update the affected package(s) to the fixed version shipped in RHSA-2026:3955 (`sudo dnf update` / `yum update`).
Full advisory and evidence Open source bulletin

All Apache advisories

Follow CVE-2026-27446 in the free weekly digest

Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

iPhone and Android apps · New on the App Store

Get alerts for new CVEs on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts on Android See app features