CVE-2026-27446

CVE-2026-27446 is a Critical Missing Authentication for Critical Function (CWE-306) vulnerability affecting Apache Artemis (versions 2.50.0-2.51.0) and Apache ActiveMQ Artemis (versions 2.11.0-2.44.0). An unauthenticated remote attacker can exploit this by forcing a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This can lead to message injection into and/or exfiltration from any queue, impacting environments allowing both untrusted incoming and outgoing Core protocol connections. With a CVSS score of 9.3 (CRITICAL), this vulnerability has a network attack vector and low attack complexity, requiring no privileges or user interaction. The potential impact is high for confidentiality and integrity, with a moderate impact on availability. The FAUCET Risk Score is 53/100, indicating significant risk. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. However, the vulnerability has garnered community attention with 3 mentions, including discussions on security mailing lists and Japanese media coverage, suggesting awareness within the security community.