PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28812 Apache Software Foundation CVE debrief

Apache JSPWiki up to 2.12.3 has a UserManager impersonation vulnerability CVE-2026-28812, with a CVSS score of 9.8. This vulnerability allows attackers to escalate privileges due to a lack of checks in the UserManager. The affected product is Apache JSPWiki up to version 2.12.3, and the vulnerability class is impersonation. The likely operational impact is privilege escalation. The source-confidence limits are based on the CVE record and NVD entry, which provide limited information. Users should upgrade to version 2.12.4 or newer. Further investigation is needed to determine the full scope of the vulnerability.

Vendor
Apache Software Foundation
Product
Apache JSPWiki
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-07-31
Advisory published
2026-07-30
Advisory updated
2026-07-31

Who should care

Administrators and users of Apache JSPWiki up to version 2.12.3 should be aware of this vulnerability and take steps to mitigate it. Affected operators include system administrators, security teams, and vulnerability management teams. The affected platform is Apache JSPWiki. The vulnerability-management impact is high, as the vulnerability has a CVSS score of 9.8 and is considered critical.

Technical summary

The UserManager in Apache JSPWiki up to 2.12.3 lacks checks, allowing impersonation. This may allow attackers to escalate privileges. The vulnerability has a CVSS score of 9.8 and is considered critical. The affected product is Apache JSPWiki up to version 2.12.3. The vulnerability class is impersonation. The likely operational impact is privilege escalation. The source-confidence limits are based on the CVE record and NVD entry, which provide limited information.

Defensive priority

Upgrade to version 2.12.4 or newer.

Recommended defensive actions

  • Upgrade to version 2.12.4 or newer.
  • Monitor for potential exploitation attempts.
  • Verify UserManager configuration.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to determine the full scope of the vulnerability. The UserManager impersonation vulnerability in Apache JSPWiki up to 2.12.3 may allow attackers to escalate privileges. Limited evidence suggests that this vulnerability has a CVSS score of 9.8 and is considered critical. However, additional verification is required to confirm the accuracy of this information.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T16:17:10.967Z and has not been modified since then.