CVE-2026-76986

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every other option body in the same select is escaped according to the escape-model-strings setting. The body comes from getNullValidDisplayValue() or getNullKeyDisplayValue(), both of which are protected, so what they return is not necessarily the plain text the default implementation reads from a resource bundle. An application is affected where it overrides one of those methods and returns a value holding data an attacker can influence, or where its own nullValid or null bundle entry holds such a value. The bundles shipped with Wicket contain plain text. RadioChoice overrides getDefaultChoice to emit no default option and is not affected. As a workaround, escape the value in the override. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

• CWE-79

• https://lists.apache.org/thread/4qltg6wckqz8wbs1f4jzqlc0yccpgvllVendor Advisory, Mailing List
• https://www.openwall.com/lists/oss-security/2026/08/31/6Mailing List, Third Party Advisory

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7698A vulnerability was identified in Tiandy Easy7 Integrated Ma…7.3
• CVE-2026-76980ZohoCorp ManageEngine OpManager and Firewall Analyzer versio…7.4
• CVE-2026-76982Improper neutralization of input during web page generation …5.4
• CVE-2026-76983Improper neutralization of input during web page generation …5.4
• CVE-2026-76984Improper neutralization of input during web page generation …5.4
• CVE-2026-76985Improper neutralization of input during web page generation …5.4
• CVE-2026-76987A security flaw has been discovered in liftoff-sr CIPster 18…7.3
• CVE-2026-76988A weakness has been identified in liftoff-sr CIPster 1802525…5.3
• CVE-2026-76989A security vulnerability has been detected in liftoff-sr CIP…5.3
• CVE-2026-7699A security flaw has been discovered in Dromara MaxKey up to …6.3
• CVE-2026-76990A vulnerability has been found in code-projects Simple Inven…7.3
• CVE-2026-76991A vulnerability was found in itsourcecode Hospital Managemen…6.3