Is Artemis server used by EJBCA CE ?

[fco-code-org]

Hello,

EJBCA needs an App Server, right ?
EJBCA is supported on Wildfly, right ?
As Wildfly supports Jakarta EE, it requires a JMS broker which is Artemis, right ?

But EJBCA application deployed in Wildfly doesn't use Artemis, right ?
So the CVE-2026-27446 is not exploitable, right ?

Best Regards.

[cookesan]

I would not treat Artemis as an EJBCA CE runtime dependency just because WildFly includes an Artemis/JMS subsystem.

In the current EJBCA CE source I do not find JMS usage (javax.jms, jakarta.jms, MessageDriven) or Artemis references. The queue-related classes in EJBCA are publisher/audit queue implementations in EJBCA's own code, not evidence that the application is using the WildFly Artemis broker.

So the distinction is:

• WildFly can include/provide Artemis because it is a Jakarta EE application server.
• EJBCA CE can be deployed on WildFly without necessarily using JMS/Artemis.
• If you are hardening/minimizing WildFly, do not remove subsystems blindly, but there is no source-level indication here that EJBCA CE itself depends on Artemis messaging.

The safest validation is to deploy EJBCA on your target WildFly profile and check boot/deployment logs after disabling only the messaging subsystem in a test environment.

[mike-agrenius-kushner]

Hi,

As noted by the helpful poster above, EJBCA doesn't use JMS in any capacity. I can't say if Wildfly uses Artemis internally or if it's just bundled with it, but EJBCA itself does not rely on any form of messaging.

Cheers,
Mike