Based on the description, it is inferred that an unauthenticated remote attacker can exploit a missing authentication check in Apache Artemis and the related ActiveMQ Artemis. By sending a specially crafted Core protocol request, the attacker can cause the broker to initiate an outbound federation connection to an attacker‑controlled rogue broker. Once the rogue broker is in place, the attacker may inject malicious messages into any queue or capture messages from any queue via the established federation link. The vulnerability stems from CWE‑306, a lack of authentication for a critical function, allowing unauthorized configuration changes to be executed.

The flaw affects Apache Artemis versions 2.50.0 through 2.51.0 and Apache ActiveMQ Artemis versions 2.11.0 through 2.44.0. The issue arises in environments that accept Core protocol connections from untrusted sources and permit the broker to open Core connections to untrusted destinations. Administrators should verify the exact product and version deployed against these ranges.

Based on the CVSS score of 9.3, the vulnerability is rated as critical. The EPSS score of <1% suggests a very low but nonzero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, yet the high impact and authentication bypass nature warrant urgent attention. The likely attack vector is an unauthenticated attacker sending a Core protocol connect request to the broker, causing the broker to establish an outbound federation link to an attacker‑controlled rogue broker. Exploitation requires only that the broker accept inbound Core traffic from an unauthenticated attacker and that it is allowed to open outbound Core links; no additional privileges are needed beyond the broker’s normal operation.