A critical unauthenticated remote code execution and denial of service vulnerability in Apache Artemis requires immediate patching to prevent unauthorized queue deletion.

This flaw is a result of missing authentication for a critical function (CWE-306), where the broker processes administrative Openwire commands before verifying the identity or privileges of the requester. An unauthenticated attacker can trigger this at any time, including before the connection handshake completes.

Successful exploitation of this vulnerability leads to the deletion of critical message queues, which can result in significant data loss and severe service disruption for applications relying on the Artemis broker. Given the CVSS score of 9.1, the ability for an unauthenticated attacker to remotely destroy infrastructure components without interaction represents a high risk to business continuity and operational integrity.

Immediate Action: Upgrade to Apache Artemis version 2.57.0 immediately, as this release contains the necessary security fixes to enforce authentication.

Proactive Monitoring: Review broker logs for unexpected Openwire commands or unauthorized connection attempts, and monitor for sudden drops in queue availability or message processing throughput.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict access to the Artemis broker to known, trusted management segments, and utilize firewalls to inspect and block unauthorized Openwire traffic.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to the availability of message-driven architectures. Organizations utilizing Apache Artemis must prioritize the transition to version 2.57.0 to eliminate the possibility of unauthenticated queue manipulation. If an immediate upgrade is not feasible, restrict network access to the affected broker as a mandatory temporary containment measure.