Is CVE-2026-123765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123765 being exploited in the wild.

How severe is CVE-2026-123765?

Informational severity, published 12 November 2026.

Which products and versions are affected?

Apache Sling XSS before 2.4.14.

Is there a fix for CVE-2026-123765?

Yes: fixed in 2.4.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123765 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123765?

Check whether you run Apache Sling XSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123765: Apache Sling XSS cross-site scripting in getStyleToken

CVE-2026-123765 · Severity: info · Published 2026-11-12

Apache Sling XSS is a library that sanitizes user input to prevent malicious code injection in web applications. A flaw in the getStyleToken() function allows attackers to inject markup through unquoted URLs, bypassing the sanitization and executing malicious scripts in users' browsers. This could lead to session hijacking, credential theft, or defacement.

Technologies: Apache Sling XSS. Vendors: Apache.

Quick answers

Is CVE-2026-123765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123765 being exploited in the wild.
How severe is CVE-2026-123765?: Informational severity, published 12 November 2026.
Which products and versions are affected?: Apache Sling XSS before 2.4.14.
Is there a fix for CVE-2026-123765?: Yes: fixed in 2.4.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123765 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123765?: Check whether you run Apache Sling XSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.4.14

Technical details

The xssAPI.getStyleToken() method in Apache Sling XSS improperly neutralizes markup in unquoted URL attributes, allowing cross-site scripting (XSS) payloads to be injected. The vulnerability requires the attacker to supply malicious input that reaches the vulnerable function through a web application using this library. Applications using affected versions can be exploited remotely without authentication to execute arbitrary JavaScript in user browsers.

Affected products

Apache Sling XSS before 2.4.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.