PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28812 Apache Software Foundation CVE debrief

Apache JSPWiki up to 2.12.3 has a UserManager impersonation vulnerability CVE-2026-28812, with a CVSS score of 9.8. This vulnerability allows attackers to escalate privileges due to a lack of checks in the UserManager. The affected product is Apache JSPWiki up to version 2.12.3, and the vulnerability class is impersonation. The likely operational impact is privilege escalation. The source-confidence limits are based on the CVE record and NVD entry, which provide limited information. Users should upgrade to version 2.12.4 or newer. Further investigation is needed to determine the full scope of the vulnerability.

Vendor
Apache Software Foundation
Product
Apache JSPWiki
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-08-05
Advisory published
2026-07-30
Advisory updated
2026-08-05

Who should care

Administrators and users of Apache JSPWiki up to version 2.12.3 should be aware of this vulnerability and take steps to mitigate it. Affected operators include system administrators, security teams, and vulnerability management teams. The affected platform is Apache JSPWiki. The vulnerability-management impact is high, as the vulnerability has a CVSS score of 9.8 and is considered critical.

Technical summary

The UserManager in Apache JSPWiki up to 2.12.3 lacks checks, allowing impersonation. This may allow attackers to escalate privileges. The vulnerability has a CVSS score of 9.8 and is considered critical. The affected product is Apache JSPWiki up to version 2.12.3. The vulnerability class is impersonation. The likely operational impact is privilege escalation. The source-confidence limits are based on the CVE record and NVD entry, which provide limited information.

Defensive priority

Upgrade to version 2.12.4 or newer.

Recommended defensive actions

  • Upgrade to version 2.12.4 or newer.
  • Monitor for potential exploitation attempts.
  • Verify UserManager configuration.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of the vulnerability. The UserManager impersonation vulnerability in Apache JSPWiki up to 2.12.3 may allow attackers to escalate privileges. Limited evidence suggests that this vulnerability has a CVSS score of 9.8 and is considered critical. However, additional verification is required to confirm the accuracy of this information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28812 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28812

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28812 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28812

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.