CVE-2026-87718 Apache Software Foundation CVE debrief

Who should care

Defenders of applications using Apache Wicket should assess exposure and prioritize upgrading to patched versions. Reviewing custom request handler delegates is crucial to ensure they do not introduce additional vulnerabilities. Security teams and operators managing Wicket-based applications need to be aware of this vulnerability and take appropriate action to mitigate potential risks.

Why it matters

CVE-2026-87718 allows content injection attacks in Apache Wicket applications due to missing Content-Security-Policy headers. Defenders should prioritize upgrading to patched versions and review custom request handler delegates.

• Content injection attacks are possible due to missing Content-Security-Policy headers
• Upgrade to patched versions is required to fix the issue
• Review of custom request handler delegates is necessary

Technical summary

Apache Wicket 10.10.0, 10.11.0, and 9.24.0 do not set Content-Security-Policy headers on pages with nested request handler delegates. This allows for content injection attacks. The issue arises from the framework's handling of nested delegates, where only a single delegate level is unwrapped. The vulnerability is fixed in versions 10.12.0 and 9.25.0. Defenders should prioritize upgrading to patched versions to prevent content injection attacks. Review of custom request handler delegates is necessary to ensure they do not exacerbate the issue.

Defensive priority

Defenders should prioritize upgrading to patched versions to prevent content injection attacks.

Recommended defensive actions

• Upgrade to Apache Wicket version 10.12.0 or 9.25.0
• Review application code for custom request handler delegates
• Verify Content-Security-Policy headers are set correctly
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, confirming that Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 are affected. The issue is fixed in versions 10.12.0 and 9.25.0. Defenders should verify the CSP headers are set correctly and review custom request handler delegates. Evidence from the CVE Program and NVD supports this assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.