Apache Wicket AjaxNewWindowNotifyingBehavior Cross-Site Scripting (XSS) Vulnerability (CVE-2026-82956)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0, specifically when AjaxNewWindowNotifyingBehavior is explicitly used
Attackers can manipulate the browser's window.name to execute arbitrary malicious JavaScript within the victim's session context, leading to session hijacking and data theft
Immediately upgrade to patched Apache Wicket versions 8.20.0, 9.25.0, or 10.12.0
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update your project's build configuration to use the patched versions of Apache Wicket.
For Maven (pom.xml):
<!-- Upgrade Apache Wicket dependency to a secure version -->
<dependency>
<groupId>org.apache.wicket</groupId>
<artifactId>wicket-core</artifactId>
<version>10.12.0</version> <!-- Or 8.20.0, 9.25.0 -->
</dependency>For Gradle (build.gradle):
implementation 'org.apache.wicket:wicket-core:10.12.0'2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, temporarily remove the usage of AjaxNewWindowNotifyingBehavior from your codebase, or implement a custom wrapper to sanitize the incoming windowName parameter before it is processed.
// Example of a custom behavior to sanitize input if the default behavior must be used
public class SanitizedAjaxNewWindowNotifyingBehavior extends AjaxNewWindowNotifyingBehavior {
public SanitizedAjaxNewWindowNotifyingBehavior(String name) {
super(name);
}
// Implement strict alphanumeric validation on the windowName parameter to block special characters like single quotes
}3. Log Audit & IoC Verification Commands
Run the following command in your project root directory to identify if the vulnerable component is being used in your codebase.
# Search for references to the vulnerable behavior class in the source code
grep -rn 'AjaxNewWindowNotifyingBehavior' ./src/Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-82956) is caused by improper neutralization of input during web page generation (CWE-79) within the org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior class of the Apache Wicket framework. The component detects when a page instance is opened in a second browser window or tab by querying the browser's window.name property. This value is sent to the server as the windowName request parameter and stored in the page's serialized state. When the page is subsequently rendered, Wicket constructs an Ajax precondition by embedding this stored value directly into a single-quoted JavaScript string literal without any escaping or validation, leading to raw script injection.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this by setting the window.name property of a browser context (e.g., via a malicious link that opens the target application in a new tab) to a payload containing a single quote and executable script (e.g., '; alert(document.cookie); //). When the Wicket application receives this value, it serializes and stores it. On every subsequent render of that page instance, Wicket emits the unescaped value into the page as raw JavaScript. The single quote breaks out of the string literal, causing the injected script to execute within the application's origin.
3. Infrastructure & Business Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the user's browser session, enabling session hijacking, credential theft, and unauthorized actions via CSRF. This poses a significant risk to enterprise portals and financial applications built on Wicket. However, the vulnerability is limited to applications that explicitly instantiate and attach AjaxNewWindowNotifyingBehavior to their components, as the framework does not install this behavior by default.
Official Vendor Advisories & References
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the request parameter windowName, and remembers what the browser reported in a field of the behaviour. That field is part of the page's serialized state, so the remembered value stays in the page store for as long as the page instance does. On every later render of that page instance the behaviour builds the precondition of its Ajax call by substituting the remembered value into a single-quoted JavaScript string literal, and Wicket writes that precondition into the page as raw JavaScript, because the precondition of an Ajax call listener is script supplied by the caller and is emitted without quoting or escaping. Nothing on that path escapes the value. The window name is client-supplied and Wicket applies no validation to it, so a remembered name containing a single quote ends the literal and the rest of it runs as script in the application's origin, every time that page instance is rendered. An application is affected only where it has explicitly added AjaxNewWindowNotifyingBehavior to a component. No part of the framework installs the behaviour, so an application that does not use it is not affected. The name the behaviour generates for itself, when the browser reports no name at all, is a random UUID and is not client-supplied. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.
Frequently Asked SecOps Questions (CVE-2026-82956)
FAQQ1. How critical is CVE-2026-82956 and is it actively exploited in the wild?
CVE-2026-82956 is rated CVSS 7.6 (HIGH) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-82956?
Primary impacted vendors include apache across wicket. Scope summary: Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 (only when AjaxNewWindowNotifyingBehavior is explicitly used)
Q3. What temporary mitigations or workarounds exist for CVE-2026-82956 before patching?
[Mitigation] Immediately upgrade to patched Apache Wicket versions 8.20.0, 9.25.0, or 10.12.0 Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-82956
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache Wicket SmartLinkLabel Cross-Site Scripting (XSS) Vulnerability (CVE-2026-83539)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 utilizing SmartLinkLabel or SmartLinkMultiLineLabel components
Apache Wicket JavaScriptUtils Escape Bypass Remote Script Execution Vulnerability (CVE-2026-83559)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x or older versions
Apache Wicket Cross-Site Scripting (XSS) Vulnerability due to Missing Resource Bundle Escaping (CVE-2026-111089)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0
Apache Wicket WebSocket Resource Missing Authorization Vulnerability (CVE-2026-82115) Analysis & Mitigation Guide
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x releases
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.