https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-75880.htmlhttps://patchthecve.com/cve/CVE-2026-75880.htmlFri, 18 Sep 2026 15:17:11 +0000MEDIUM 6.5: An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; https://patchthecve.com/cve/CVE-2026-67593.htmlhttps://patchthecve.com/cve/CVE-2026-67593.htmlWed, 16 Sep 2026 01:10:17 +0000CRITICAL 9.1: A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Arthttps://patchthecve.com/cve/CVE-2026-57967.htmlhttps://patchthecve.com/cve/CVE-2026-57967.htmlFri, 09 Oct 2026 16:17:28 +0000CRITICAL 9.8: An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0https://patchthecve.com/cve/CVE-2026-57822.htmlhttps://patchthecve.com/cve/CVE-2026-57822.htmlWed, 16 Sep 2026 01:10:26 +0000MEDIUM 6.5: When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not uthttps://patchthecve.com/cve/CVE-2026-49364.htmlhttps://patchthecve.com/cve/CVE-2026-49364.htmlWed, 16 Sep 2026 01:10:31 +0000CRITICAL 9.1: An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommenhttps://patchthecve.com/cve/CVE-2026-49363.htmlhttps://patchthecve.com/cve/CVE-2026-49363.htmlWed, 16 Sep 2026 01:10:36 +0000HIGH 7.5: An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are rhttps://patchthecve.com/cve/CVE-2026-49362.htmlhttps://patchthecve.com/cve/CVE-2026-49362.htmlWed, 16 Sep 2026 01:10:42 +0000HIGH 7.5: An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. User