Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte) 0xfffffff0. Documentation for interceptors is available at https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18054 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    *bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly     (CVE-2025-14813)

    * bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion     (CVE-2026-3505)

    * bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid     (CVE-2026-5588)

    * bcprov-ext-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)

    * bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)

    * netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)

    * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding     extension values (CVE-2026-33870)

    * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to     missing authentication (CVE-2026-27446)

    * org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects     [(CVE-2026-27830)

    * org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob     expressions (CVE-2026-27904)

    * mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted     objects (CVE-2026-27727)

    * io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI  (CVE-2025-23368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18055 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.6 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.5, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.6 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * bcprov-jdk18on: GOSTCTR implementation unable to process more than 255 blocks correctly (CVE-2025-14813)

    *bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly     (CVE-2025-14813)

    * bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion     (CVE-2026-3505)

    * bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid     (CVE-2026-5588)

    * bcprov-ext-jdk15on: LDAP injection vulnerability in LDAPStoreHelper.java (CVE-2026-0636)
    * bcprov-jdk12: private key leakage via non-constant time comparisons (CVE-2026-5598)

    * netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood (CVE-2026-33871)

    * netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding     extension values (CVE-2026-33870)

    * artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to     missing authentication (CVE-2026-27446)

    * org.hibernate.orm/hibernate-c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects     (CVE-2026-27830)

    * org.keycloak-keycloak-parent: Minimatch: Denial of Service via catastrophic backtracking in glob     expressions (CVE-2026-27904)

    * mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted     objects (CVE-2026-27727)

    * io.hawt-project: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

    * wildfly-elytron-integration: Wildfly Elytron Brute Force Attack via CLI (CVE-2025-23368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Artemis (formerly Apache ActiveMQ Artemis) installed on the remote host is affected by a vulnerability:

  - Missing Authentication for Critical Function vulnerability. An unauthenticated remote attacker     can use the Core protocol to force a target broker to establish an outbound Core federation     connection to an attacker-controlled rogue broker. This could potentially result in message     injection into any queue and/or message exfiltration from any queue via the rogue broker.
    (CVE-2026-27446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ     Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to     establish an outbound Core federation connection to an attacker-controlled rogue broker. This could     potentially result in message injection into any queue and/or message exfiltration from any queue via the     rogue broker. This impacts environments that allow both: - incoming Core protocol connections from     untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets     This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0     through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
    The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor     receiving connections from untrusted sources. Incoming Core protocol connections are supported by default     via the artemis acceptor listening on port 61616. See the protocols URL parameter configured for the     acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use     two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper     SSL certificate when establishing a connection before any message protocol handshake is attempted. This     will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor     to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte)     0xfffffff0. Documentation for interceptors is available at     https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
    (CVE-2026-27446)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ
    Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to
    establish an outbound Core federation connection to an attacker-controlled rogue broker. This could
    potentially result in message injection into any queue and/or message exfiltration from any queue via the
    rogue broker. This impacts environments that allow both: - incoming Core protocol connections from
    untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets
    This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0
    through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue.
    The issue can be mitigated by one of the following: - Remove Core protocol support from any acceptor
    receiving connections from untrusted sources. Incoming Core protocol connections are supported by default
    via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the
    acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use
    two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper
    SSL certificate when establishing a connection before any message protocol handshake is attempted. This
    will prevent unauthenticated exploitation of this vulnerability. - Implement and deploy a Core interceptor
    to deny all Core downstream federation connect packets. Such packets have a type of (int) -16 or (byte)
    0xfffffff0. Documentation for interceptors is available at
    https://artemis.apache.org/components/artemis/documentation/latest/intercepting-operations.html .
    (CVE-2026-27446)

ID	Name	Product	Family	Severity
315192	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.6 (RHSA-2026:18054)	Nessus	Red Hat Local Security Checks	critical
315188	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.6 (RHSA-2026:18055)	Nessus	Red Hat Local Security Checks	critical
301278	Apache Artemis 2.11.0 < 2.45.0 / 2.50.0 < 2.52.0 Missing Authentication (CVE-2026-27446)	Nessus	Misc.	critical
301141	Linux Distros Unpatched Vulnerability : CVE-2026-27446	Nessus	Misc.	critical
438379	SCA: security update for org.apache.artemis:artemis-server (GHSA-fw88-pf9m-p947)	Tenable Cloud Security	SCA Checks	critical
438379	SCA: security update for org.apache.artemis:artemis-server (GHSA-fw88-pf9m-p947)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-27446

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical