Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-10T05:40:15 artemis-server: Apache Artemis — session hijack via missing authentication 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-306

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.

in Apache Artemis, the REATTACH_SESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)

Red Hat AMQ Broker 7.13.6 2026-09-10T00:00:00Z RHSA-2026:66545 artemis-server Red Hat AMQ Broker 7.14.1 2026-09-10T00:00:00Z RHSA-2026:66488 artemis-server Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-activemq-artemis-0:2.16.0-23.redhat_00058.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-annotations-0:2.18.9-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-core-0:2.18.9-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-databind-0:2.18.9-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-jaxrs-providers-0:2.18.9-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-modules-base-0:2.18.9-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-wildfly-0:7.4.25-6.GA_redhat_00005.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-activemq-artemis-0:2.16.0-23.redhat_00058.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-annotations-0:2.18.9-1.redhat_00003.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-core-0:2.18.9-1.redhat_00003.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-databind-0:2.18.9-1.redhat_00003.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-jaxrs-providers-0:2.18.9-1.redhat_00003.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-modules-base-0:2.18.9-1.redhat_00003.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-wildfly-0:7.4.25-6.GA_redhat_00005.1.el8eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-activemq-artemis-0:2.16.0-23.redhat_00058.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-annotations-0:2.18.9-1.redhat_00003.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-core-0:2.18.9-1.redhat_00003.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-databind-0:2.18.9-1.redhat_00003.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-jaxrs-providers-0:2.18.9-1.redhat_00003.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-modules-base-0:2.18.9-1.redhat_00003.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el9eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 2026-09-15T00:00:00Z RHSA-2026:67604 eap7-wildfly-0:7.4.25-6.GA_redhat_00005.1.el9eap Red Hat JBoss Enterprise Application Platform 8 Affected artemis-server Red Hat JBoss Enterprise Application Platform Expansion Pack Affected artemis-server https://www.cve.org/CVERecord?id=CVE-2026-57967 https://nvd.nist.gov/vuln/detail/CVE-2026-57967