Apache ActiveMQ Artemis CVE-2026-57967: Unauthenticated Session Hijack, CVSS 9.8

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Infrastructure security for US and EU enterprise teams

The short answer

What is CVE-2026-57967?

Apache ActiveMQ Artemis is the high-performance message broker at the heart of many event-driven and microservice systems — the JMS and multi-protocol backbone that moves orders, payments, inventory changes, and audit events between services. On September 10, 2026, the Apache Software Foundation disclosed a batch of Artemis advisories, and CVE-2026-57967 is the most severe: a critical missing-authentication vulnerability (CWE-306) scored CVSS 9.8.

The flaw lives in the broker's CORE protocol, the native wire protocol Artemis clients use to talk to the server. CORE supports session reattachment — a resilience feature that lets a client transparently resume an existing session after a brief connection drop instead of re-authenticating from scratch. The bug is that the broker accepts a SESSION_REATTACH request without adequately verifying that the requester is the legitimate owner of the session being reattached. An attacker who can reach the broker and reference a valid session identifier can therefore claim ownership of someone else's authenticated session. Because this is broker-side infrastructure, hardening it is a DevOps and platform concern as much as an application one.

The severity metrics tell the story: network-reachable, low attack complexity, no privileges, and no user interaction required, with high impact to confidentiality, integrity, and availability. In other words, an unauthenticated attacker on a reachable network path can take over a privileged, already-authenticated session and act with its rights. The Apache project corrected the reattachment logic in Artemis 2.57.0, which now validates a reattach request against the current authentication state before honouring it.

How the session hijack works

Session reattachment exists for a good reason. In a busy Artemis deployment, TCP connections drop and re-establish constantly, and forcing a full re-authentication and state rebuild on every blip would be slow and fragile. So the CORE protocol lets a reconnecting client present a SESSION_REATTACH packet that references an existing server-side session and picks up where it left off — same authenticated identity, same open producers and consumers, same in-flight state.

CVE-2026-57967 breaks the trust assumption underneath that convenience. The broker does not sufficiently confirm that whoever sends the reattach request is the original, authenticated owner of the referenced session. An attacker who can guess or observe a valid session identifier from a prior authenticated connection can send their own SESSION_REATTACH packet claiming that session — and the broker grants access to everything associated with it. No password, no token, no user prompt: network reach plus a valid session reference becomes session takeover.

From there, the attacker inherits the hijacked session's permissions on the broker. Depending on what that session was authorised to do, that can mean reading messages in transit, injecting or replaying messages to downstream consumers, tampering with or draining queues, or disrupting message flow entirely. As of publication there is no confirmation of broad in-the-wild exploitation, and Apache describes this as a disclosed rather than known-exploited flaw. That is cold comfort: the attack path is unauthenticated and low-complexity, and once technical detail on a CVSS 9.8 bug is public, opportunistic scanning of exposed brokers is the realistic expectation, not a remote one.

What it means for US & EU software teams

Strip away the protocol specifics and three durable lessons remain. First, your message broker is production infrastructure, not plumbing you can forget. Teams lavish authentication and rate-limiting on their public HTTP APIs, then run Artemis with a permissive acceptor because “it’s internal.” A broker that routes payments and audit events deserves the same threat model as your edge. CVE-2026-57967 is a reminder that the messaging tier is a first-class part of your attack surface.

Second, resilience features are security surface. Session reattachment, auto-reconnect, failover, and replay mechanisms all exist to make systems more robust — and each one is a place where identity can be assumed instead of proven. When you build or commission event-driven systems, every “resume where you left off” path needs to answer one question explicitly: how do we verify this is the same principal? Baking that check into the design is far cheaper than retrofitting it after a CVE.

Third, network exposure is the multiplier. The difference between “critical CVE we patched calmly” and “incident” is almost always whether the vulnerable port was reachable from where the attacker sits. For EU teams, an unauthenticated takeover of a broker carrying personal or financial data is squarely a GDPR, NIS2, and DORA concern — the kind of exposure regulators expect you to have segmented away by design. Knowing exactly which brokers, admin panels, and internal services are reachable, and from where, is the single highest-leverage control here.

What to do now

1. Upgrade to Artemis 2.57.0. Move any broker on an affected version — Apache Artemis 2.50.0–2.56.0 or legacy ActiveMQ Artemis 1.0.0–2.44.0 — to 2.57.0. Treat it as a priority change, not a routine maintenance item.
2. Get broker ports off untrusted networks. The CORE acceptor (commonly TCP 61616) and the management interface should be reachable only from trusted application subnets. Nothing about a message broker should be exposed to the public internet.
3. Enforce TLS and authentication on every acceptor. Require encrypted, authenticated connections for all client and inter-broker traffic, and apply least-privilege roles on addresses and queues so a single compromised session cannot touch everything.
4. Hunt for anomalies. Review broker logs for unusual connection churn and reattachment activity, unexpected source addresses on the CORE acceptor, and consumers you cannot account for. Alert on reattachment patterns that do not match your client fleet.
5. Put messaging in your pen-test scope. Brokers are routinely left out of security testing even though they carry the most sensitive traffic. Add the messaging tier to your next penetration test and audit adjacent internal services for similar “assumed identity” paths.

Frequently asked questions

Sources

SecurityOnline — Apache Artemis Vulnerabilities Expose ActiveMQ Artemis Flaws
VulDB — CVE-2026-57967 in ActiveMQ Artemis (CVSS, affected versions, fix)
Apache Software Foundation — ActiveMQ Security Advisories