CVE-2026-84177 Apache Software Foundation CVE debrief

Who should care

Developers and administrators using Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 should be aware of this vulnerability and take steps to upgrade to a fixed version.

Why it matters

CVE-2026-84177 is a vulnerability in Apache Wicket that allows an attacker to access developer-authored template content by manipulating the URL. The issue affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0, or 10.12.0, which fix the issue. The vulnerability requires verification from the supplied official sources to determine the actual impact and remediation steps.

• An attacker may be able to access developer-authored template content, potentially exposing component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names.
• The vulnerability requires the attacker to know the class name in the target package and the component itself, and Wicket writes fully qualified class names into the URL of every package resource it renders.
• The access is read-only, and what is disclosed is developer-authored template content; no user data, credential or session material is reachable this way.
• The vulnerability does not allow for arbitrary code execution, data theft, outage, or business impact.

Technical summary

The vulnerability is caused by incorrect behavior order in Apache Wicket, which allows an attacker to access developer-authored template content by manipulating the URL. The issue affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0, or 10.12.0, which fix the issue. The vulnerability requires verification from the supplied official sources to determine the actual impact and remediation steps. An application is affected if the simple name of any of its component classes contains an underscore and no shorter part of that name is itself a class.

Defensive priority

Upgrade to a fixed version of Apache Wicket

Recommended defensive actions

• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Upgrade to Apache Wicket version 8.20.0, 9.25.0, or 10.12.0

Evidence notes

The vulnerability is caused by incorrect behavior order in Apache Wicket, which allows an attacker to access developer-authored template content by manipulating the URL. This issue affects Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. The vulnerability requires verification from the supplied official sources to determine the actual impact and remediation steps. An attacker may be able to access developer-authored template content, potentially exposing component structure, developer The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.