External risk intelligence

Apache Artemis and ActiveMQ Artemis Remote Queue Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-67593

Apache ActiveMQ Artemis is a message broker commonly deployed as an edge service or middleware component to facilitate communication between distributed systems, including those that span network boundaries. While often positioned behind firewalls, message brokers frequently act as gateways for external or inter-site traffic, making them reachable in many standard deployment configurations.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache Artemis message brokers allows an attacker to delete critical queues without authentication, potentially disrupting messaging services. This issue affects specific versions of Apache Artemis and Apache ActiveMQ Artemis.

Attackers can delete message queues remotely.
Important for protecting critical messaging infrastructure.
Confirm if your Artemis systems are exposed.

Attack Path

How an attacker could exploit the issue

A remote attacker can send a specially crafted Openwire RemoveSubscriptionInfo command to the Artemis broker to delete a queue. This can occur before or after the connection is authenticated and authorized, potentially leading to data loss or denial of service.

No authentication required.
Send a crafted command.
Denial of service and data integrity risk.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could send a specially crafted command to delete message queues on an Apache Artemis broker. This could occur before or after authentication and authorization checks are completed.

Message queues could be deleted.
Attacker sends crafted command remotely.
Service availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the queue deletion functionality of Apache Artemis, potentially allowing unauthorized remote attackers to disrupt messaging services. Infrastructure and platform teams responsible for the Artemis message broker are likely to own this issue. The first practical step is to identify all deployed Artemis instances, confirm their reachability and criticality, and then determine the accountable owner to plan remediation based on the identified risk.

Platform and infrastructure teams own this issue.
Verify broker reachability and critical queues.
Plan upgrades during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Artemis?

Apache Artemis and ActiveMQ Artemis are high-performance, multi-protocol message brokers. They act as central messaging hubs, enabling different parts of a distributed software system to exchange data reliably. By managing queues, these brokers ensure messages are stored and delivered correctly between applications.

How does CVE-2026-67593 impact Artemis brokers?

This vulnerability is classified as CWE-306, which refers to a missing authentication for a critical function. In this case, the broker fails to verify user credentials before processing a specific command. An attacker can exploit this to delete queues, leading to service disruption or data loss because the system accepts the command without confirming the sender's identity.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not required. The flaw exists because the broker processes the malicious Openwire command before checking credentials. Consequently, standard internal traffic that is already authenticated does not trigger the bug, but neither does it provide protection; the vulnerability is triggered simply by sending the command from any network location that can reach the broker.

Why is this CVE considered relevant to my infrastructure?

Halo Surface Signal indicates that message brokers like Artemis are frequently deployed as middleware or edge services to bridge communication between systems. Because they often handle inter-site traffic, they are frequently reachable across network boundaries, making it highly probable that your broker is accessible to a wider range of network sources than typical internal services.

When should I take action to address this issue?

You should begin by auditing your environment to locate all running instances of the affected versions. Once you have identified these systems and confirmed their role in your architecture, your primary response is to plan a version upgrade to 2.57.0. Coordinate with your platform teams to schedule this update during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.