Is CVE-2026-82559 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82559 being exploited in the wild.

How severe is CVE-2026-82559?

Informational severity, published 1 November 2026.

Which products and versions are affected?

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 6.0.0 onwards (unsupported).

Is there a fix for CVE-2026-82559?

Yes: fixed in 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82559 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82559?

Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82559: Apache Wicket insufficient WebSocket session expiration

CVE-2026-82559 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web framework that handles user sessions and WebSocket connections. When a user's session is terminated by the web server, WebSocket connections in Wicket fail to disconnect and continue using the stale session data, allowing an attacker with an open connection to maintain access to that user's identity and permissions even after logout. This affects applications using Wicket's native WebSocket support on pages requiring authentication.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-82559 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82559 being exploited in the wild.
How severe is CVE-2026-82559?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 6.0.0 onwards (unsupported).
Is there a fix for CVE-2026-82559?: Yes: fixed in 8.20.0, 9.25.0, 10.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82559 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82559?: Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.20.0, 9.25.0, 10.12.0

Technical details

The vulnerability exists in org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest(), which copies the container session into an HttpSessionCopy at connection time and reuses it for all subsequent frames. When the container invalidates the session via idle timeout, security framework logout, or session replacement, the WebSocket connection continues to resolve the stale session copy rather than the invalidated live session. This allows authorization decisions within WebSocket callbacks to be made against revoked identities. The issue affects WebSocketBehavior on pages and all WebSocketResource connections; it does not affect applications without native WebSocket support.

Affected products

Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, 10.0.0 through 10.11.0, and 6.0.0 onwards (unsupported)

Timeline

2026-11-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.