PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32642 Apache CVE debrief

CVE-2026-32642 is an Incorrect Authorization (CWE-863) vulnerability in Apache Artemis and Apache ActiveMQ Artemis. The vulnerability occurs when an application using the OpenWire protocol attempts to create a non-durable JMS topic subscription on an address that doesn't exist with an authenticated user who has the 'createDurableQueue' permission but does not have the 'createAddress' permission and address auto-creation is disabled. In this circumstance, a temporary address will be created whereas the attempt to create the non-durable subscription should instead fail since the user is not authorized to create the corresponding address.

Vendor
Apache
Product
Artemis
CVSS
LOW 2.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-24
Original CVE updated
2026-06-15
Advisory published
2026-03-24
Advisory updated
2026-06-15

Who should care

Users of Apache Artemis from version 2.50.0 through 2.52.0 and Apache ActiveMQ Artemis from version 2.0.0 through 2.44.0 should upgrade to version 2.53.0.

Technical summary

The vulnerability affects Apache Artemis from 2.50.0 through 2.52.0 and Apache ActiveMQ Artemis from 2.0.0 through 2.44.0. The CVSS score is 2.3, and the severity is LOW.

Defensive priority

LOW

Recommended defensive actions

  • Upgrade to version 2.53.0

Evidence notes

The vulnerability was published on 2026-03-24T08:16:01.430Z and modified on 2026-06-15T13:03:40.357Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-32642 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-32642

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-32642 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32642

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.