CVE-2026-83539 Apache Software Foundation CVE debrief

Who should care

Defenders and developers using Apache Wicket versions from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, and from 10.0.0 through 10.11.0 should assess exposure and prioritize upgrading to a fixed version.

Why it matters

The vulnerability in Apache Wicket allows an attacker to execute script, potentially leading to phishing and social engineering attacks, and impacting data integrity and confidentiality. Defenders and developers should assess exposure and prioritize upgrading to a fixed version.

• Execution of script in the application's origin and in the reader's own session when a user clicks a link
• Potential for phishing and social engineering attacks
• Possible impact on data integrity and confidentiality
• Need for verification of affected systems and applications

Technical summary

Apache Wicket versions from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, and from 10.0.0 through 10.11.0 are affected by an improper neutralization of input during web page generation vulnerability. The vulnerability allows an attacker to execute script when a user clicks a link. The issue arises from the SmartLinkLabel and SmartLinkMultiLineLabel components, which display a text value and turn any URL they find in it into a hyperlink without proper validation of the URL scheme. This can lead to phishing and social engineering attacks, and impact data integrity and confidentiality.

Defensive priority

Defenders should prioritize upgrading to Apache Wicket version 8.20.0, 9.25.0, or 10.12.0 to address the improper neutralization of input during web page generation vulnerability.

Recommended defensive actions

• Upgrade to Apache Wicket version 8.20.0, 9.25.0, or 10.12.0
• Review and update Content-Security-Policy to prevent script execution
• Verify and update affected systems and applications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail indicate that Apache Wicket versions from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, and from 10.0.0 through 10.11.0 are affected by the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.