Quick answers
- Is CVE-2026-19651 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19651 being exploited in the wild.
- How severe is CVE-2026-19651?
- High severity, with a CVSS score of 7.4, published 8 September 2026.
- Which products and versions are affected?
- IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, 3.33.1 through 3.33.3.
- Is there a fix for CVE-2026-19651?
- A patch was published on 2026-09: Fixed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19651 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19651?
- Check whether you run IBM Enterprise Build of Quarkus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability (CVE-2026-19651) is an authorization bypass flaw in the Quarkus quarkus-spring-web extension caused by incorrect mapping of URL query string input to trusted values (CWE-639). An unauthenticated attacker can craft malicious query parameters to bypass authorization checks over the network with moderate complexity. Successful exploitation grants unauthorized access to protected application endpoints. The issue affects IBM Enterprise Build of Quarkus versions 3.27.1–3.27.5 and 3.33.1–3.33.3; patches are available in 3.27.5.SP1 and 3.33.3.SP1.
Affected products
- IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, 3.33.1 through 3.33.3
Timeline
- 2026-09-08: disclosed
- 2026-09: patched: Fixed in IBM Enterprise Build of Quarkus 3.27.5.SP1 and 3.33.3.SP1