Is CVE-2026-96677 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96677 being exploited in the wild.

How severe is CVE-2026-96677?

Informational severity, published 5 November 2026.

Is there a fix for CVE-2026-96677?

Yes: fixed in 9.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96677 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96677?

Check whether you run Apache Juneau at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96677: Apache Juneau cross-site scripting in HTML serialization

CVE-2026-96677 · Severity: info · Published 2026-11-05

Apache Juneau is a data serialization library used by Java web applications to generate HTML pages. The library fails to properly encode user-supplied input (from request headers, form data, or URL paths) when inserting it into page chrome elements like headers, navigation, and footers, allowing an attacker to inject malicious scripts that execute in users' browsers. This could lead to account compromise, credential theft, or unauthorized actions on behalf of affected users.

Technologies: Apache Juneau. Vendors: Apache.

Quick answers

Is CVE-2026-96677 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96677 being exploited in the wild.
How severe is CVE-2026-96677?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Apache Juneau through 9.2.0.
Is there a fix for CVE-2026-96677?: Yes: fixed in 9.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96677 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96677?: Check whether you run Apache Juneau at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.2.1

Technical details

The vulnerability is an improper input neutralization (CWE-79 cross-site scripting) in HTML document serialization. The library does not HTML-encode variable substitutions in page chrome components when those variables come from request-derived sources. The issue requires an application to explicitly include request variables in its chrome template; the default configuration is not vulnerable. An attacker can craft a malicious URL or form submission to inject unencoded HTML/JavaScript into the rendered page.

Affected products

Apache Juneau through 9.2.0

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.