Is CVE-2026-111089 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111089 being exploited in the wild.

How severe is CVE-2026-111089?

Informational severity, published 1 November 2026.

Which products and versions are affected?

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0; Apache Wicket Extensions 9.0.0 through 9.24.0, 10.0.0 through 10.11.0.

Is there a fix for CVE-2026-111089?

Yes: fixed in Wicket 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111089 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-111089?

Check whether you run Apache Wicket or Apache Wicket Extensions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111089: Apache Wicket XSS in resource bundle escaping

CVE-2026-111089 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework that generates web pages and JavaScript for users. The framework reads text labels and CSS class names from configuration files and inserts them into web pages without properly escaping special characters. An attacker who can influence these configuration files could inject malicious JavaScript code that runs in users' browsers, potentially stealing data or taking over sessions.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-111089 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111089 being exploited in the wild.
How severe is CVE-2026-111089?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0; Apache Wicket Extensions 9.0.0 through 9.24.0, 10.0.0 through 10.11.0.
Is there a fix for CVE-2026-111089?: Yes: fixed in Wicket 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111089 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-111089?: Check whether you run Apache Wicket or Apache Wicket Extensions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Wicket 8.20.0, 9.25.0, 10.12.0

Technical details

Apache Wicket writes unescaped resource bundle entries into JavaScript string literals and HTML attribute values in multiple components: MultiFileUploadField writes the mfu.delete message into JavaScript, Form and UploadProgressBar write CSS class names into attributes and JavaScript, and TrapFocusBehavior writes CSS classes into JavaScript literals. An attacker who can modify resource bundles (or influence their content through application design) can inject quotes to break out of these contexts and execute arbitrary script in the application's origin. The default CSP in Wicket 9.x and 10.x does not prevent the JavaScript injection cases because the script element carries a per-response nonce that the policy allows.

Affected products

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0
Apache Wicket Extensions 9.0.0 through 9.24.0, 10.0.0 through 10.11.0

Timeline

2026-11-01: disclosed: CVE-2026-111089 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.