PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34094 Mediawiki CVE debrief

CVE-2026-34094 is a low-severity MediaWiki vulnerability affecting specific release branches before 1.43.7, 1.44.4, and 1.45.2. The NVD record points to Wikimedia’s Phabricator issue T416090 as the vendor advisory/patch reference. Based on the published CVSS v4.0 vector, exploitation is network-reachable but requires high privileges and some user interaction, with limited confidentiality impact and no listed integrity or availability impact.

Vendor
Mediawiki
Product
Unknown
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-11
Original CVE updated
2026-05-18
Advisory published
2026-05-11
Advisory updated
2026-05-18

Who should care

Wikimedia Foundation MediaWiki operators and administrators running affected versions, especially environments where privileged users can access page editing or article-handling workflows.

Technical summary

NVD identifies the issue as a vulnerability in MediaWiki associated with program file includes/Page/Article.php. The record maps it to CWE-668 and lists affected version ranges as all versions before 1.43.7, 1.44.0 through before 1.44.4, and 1.45.0 through before 1.45.2. The CVSS v4.0 vector indicates network access, high attack complexity, required privileges, partial user interaction, and low confidentiality impact.

Defensive priority

Routine patch priority. Apply the fixed release for your branch during the next maintenance window, with higher urgency for internet-facing deployments or systems that expose privileged MediaWiki workflows to many users.

Recommended defensive actions

  • Upgrade MediaWiki to 1.43.7, 1.44.4, 1.45.2, or a later fixed release in your supported branch.
  • Review Wikimedia Phabricator issue T416090 for vendor guidance and patch context.
  • Inventory all MediaWiki instances to confirm whether any affected version branches are deployed.
  • Validate the upgrade in a staging environment before production rollout.
  • Record the remediation in your vulnerability management and patch tracking process.

Evidence notes

This debrief is based only on the supplied NVD record and the linked Wikimedia Phabricator reference. The version ranges, CVSS characteristics, and CWE mapping come from the official NVD metadata; the vendor reference is T416090. No exploit details are included because none were provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34094 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34094

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34094 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34094

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://phabricator.wikimedia.org/T416090

    c4f26cc8-17ff-4c99-b5e2-38fc1793eacc - Issue Tracking, Vendor Advisory, Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.