An unauthenticated remote vulnerability in Apache ActiveMQ Artemis allows attackers to manipulate broker state and trigger a denial of service condition.

This is a missing authentication flaw (CWE-306) affecting the CORE protocol, which allows unauthenticated remote attackers to perform unauthorized administrative actions by creating arbitrary durable queues.

The ability for an unauthenticated attacker to manipulate broker queues poses a significant risk to system availability and message integrity. A successful exploit can lead to a denial of service, potentially disrupting critical messaging services that rely on the broker, which justifies the high severity CVSS score of 7.5.

Immediate Action: Upgrade all instances of Apache Artemis and Apache ActiveMQ Artemis to version 2.57.0 or later to apply the necessary authentication checks.

Proactive Monitoring: Monitor broker logs for unexpected queue creation events or unusual traffic patterns associated with the CORE protocol.

Compensating Controls: Implement network-level access controls to restrict access to the CORE protocol ports to authorized management segments only until the patch can be applied.

Public Exploit Available: No (exploit_available: false)

Given the ease of access for unauthenticated remote attackers and the direct impact on system availability, this vulnerability poses a clear risk to messaging infrastructure. Administrators should prioritize the deployment of version 2.57.0 as the primary and most effective method to mitigate this unauthorized access vector.