CVE-2026-76983 Apache Software Foundation CVE debrief

Who should care

Apache Wicket users, developers, and administrators should be aware of this vulnerability and take necessary actions to upgrade to a fixed version. This includes reviewing and updating affected systems, monitoring for potential exploitation attempts, and prioritizing upgrades based on the medium severity of this vulnerability. Security teams and vulnerability management teams should also be aware of this issue and plan for remediation efforts. Additionally, operators and platform administrators may need to take action to ensure that affected systems are properly patched or mitigated. The CVE record was published on 2026-08-31T12:17:57.297Z and has not been modified since then. Evidence is limited, and further verification is required to confirm the full scope of affected systems. Users are recommended to upgrade to version 8.19.0, 9.24.0, or 10.11.0, which fix the issue. Limited evidence suggests that the vulnerability may be exploitable, but further verification is required to confirm this. Defenders should verify that affected systems are properly patched or mitigated and monitor for potential exploitation attempts. The body of a <wicket:label> tag is markup by design and is not affected; it remains the supported way to place markup in a label. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. Unlike every other rendering path in Wicket, the resolver never consulted the escape-model-strings setting, so an application had no way to ask for the label to be escaped. The label comes from the labelled component's label model, set through FormComponent#setLabel(IModel), it is written to the markup unescaped. An application is affected where the label of a form component holds data an attacker can influence. There is no workaround. The CVE record was published on 2026-08-31T12:17:57.297Z and has 3

Technical summary

The <wicket:label> tag in Apache Wicket is vulnerable to improper neutralization of input during web page generation. An application is affected if the label of a form component holds data an attacker can influence. There is no workaround, but upgrading to version 8.19.0, 9.24.0, or 10.11.0 fixes the issue. The vulnerability affects Apache Wicket versions from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, and from 10.0.0 through 10.10.0, as well as older, unsupported releases from 1.5.0 onwards.

Defensive priority

Apache Wicket users should prioritize upgrading to a fixed version due to the medium severity of this vulnerability.

Recommended defensive actions

• Upgrade to Apache Wicket version 8.19.0, 9.24.0, or 10.11.0
• Review and update affected systems
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-76983 issue affects Apache Wicket versions from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, and from 10.0.0 through 10.10.0, as well as older, unsupported releases from 1.5.0 onwards. Users are recommended to upgrade to version 8.19.0, 9.24.0, or 10.11.0, which fix the issue. Evidence is limited, and further verification is required to confirm the full scope of affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.