Is org.apache.activemq:artemis-server affected by CVE-2025-27427?

Maven org.apache.activemq:artemis-server is affected in >=2.0.0 <2.40.0.

Is CVE-2025-27427 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

low

CVE-2025-27427

Q: Is CVE-2025-27427 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

Maven · org.apache.activemq:artemis-server

Summary

Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type

Severity: low
EPSS: 0.5% (p41)
Also known as: GHSA-3w85-5p9g-h334
Published: 2025-04-01

References

https://nvd.nist.gov/vuln/detail/CVE-2025-27427
https://github.com/apache/activemq-artemis/commit/2216a75a57f098295abb283d556c8b8bda91324d
https://github.com/apache/activemq-artemis/commit/6ab458015689303db8878941abe1bc973299fc2e

Related advisories

CVE-2026-27446 — critical · Maven/org.apache.activemq:artemis-server

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.