Is CVE-2026-43646 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43646 being exploited in the wild.

How severe is CVE-2026-43646?

High severity, with a CVSS score of 7.5, published 6 May 2026.

Which products and versions are affected?

Apache Software Foundation Wicket 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, 10.0.0 through 10.8.0; org.apache.wicket:wicket-parent (Maven) ECOSYSTEM:introduced=8.0.0-M1,last_affected=8.17.0.

Is there a fix for CVE-2026-43646?

A patch was published on 2026-05-06: Version 10.9.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43646 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43646?

Check whether you run Apache Wicket, Apache Software Foundation Wicket or org.apache.wicket:wicket-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43646: Apache Wicket information disclosure in PackageResourceGuard

CVE-2026-43646 · Severity: high · CVSS 7.5 · Published 2026-05-06

Apache Wicket, a popular framework for building Java web applications, contains a security flaw that could allow unauthorized access to sensitive files. By using specially crafted web addresses, an attacker can bypass security filters intended to protect internal application resources. This could lead to the exposure of private configuration data or proprietary application code, potentially compromising the entire system.

Technologies: Apache Wicket, Apache Software Foundation Wicket. Vendors: Apache, Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-43646 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43646 being exploited in the wild.
How severe is CVE-2026-43646?: High severity, with a CVSS score of 7.5, published 6 May 2026.
Which products and versions are affected?: Apache Software Foundation Wicket 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, 10.0.0 through 10.8.0; org.apache.wicket:wicket-parent (Maven) ECOSYSTEM:introduced=8.0.0-M1,last_affected=8.17.0.
Is there a fix for CVE-2026-43646?: A patch was published on 2026-05-06: Version 10.9.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43646 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43646?: Check whether you run Apache Wicket, Apache Software Foundation Wicket or org.apache.wicket:wicket-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in Apache Wicket's PackageResourceGuard component (CWE-200). The flaw allows a remote, unauthenticated attacker to bypass the guard's restrictions using crafted URLs to access resources that should be protected. This bypass enables the retrieval of sensitive files from the application's classpath or package resources. The issue affects multiple major versions (8.x, 9.x, and 10.x) and is resolved in version 10.9.0. Exploitation does not require user interaction or special privileges.

Affected products

Apache Wicket 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, 10.0.0 through 10.8.0

Identifiers

CVE-2026-43646
GHSA-jvv4-8wxx-m5r6

Timeline

2026-05-05: disclosed: Initial disclosure on oss-security mailing list
2026-05-06: advisory: NVD and GitHub Advisory published
2026-05-06: patched: Version 10.9.0 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.