Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-101292
Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 — Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N L H 8.2 .0043 35.0 —
AFFECTED
Product Versions Fixed
Red Hat JBoss Enterprise Application Platform 7.4.25 unspecified 2.16.0.redhat-00057
Red Hat AMQ Broker 7 unspecified —
Red Hat JBoss Enterprise Application Platform 7 unspecified —
TIMELINE
Sep 28 PATCH SHIPPED — CVE-2026-101292 (Red Hat JBoss Enterprise Application Platform 7.4.25). Fixed in Red Hat JBoss Enterprise Application Platform 7.4.25 2.16.0.redhat-00057.
Sep 28 Reserved by redhat
Sep 28 Published (CNA: redhat)
Description
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 28, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-101292 (Red Hat JBoss Enterprise Application Platform 7.4.25). Fixed in Red Hat JBoss Enterprise Application Platform 7.4.25 2.16.0.redhat-00057. |
| September 28, 2026 | Reserved | Reserved by redhat |
| September 28, 2026 | Published | Published (CNA: redhat) |
Affected
Affected products and packages — 3 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 | — | — | 2.16.0.redhat-00057 |
| Red Hat | Red Hat AMQ Broker 7 | — | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-101292 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
