Apache JSPWiki CVE-2026-28811

Exploitation requires network access to an Apache JSPWiki instance running version 2.12.3 or earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no special configuration, and no user interaction is required - exploitation is against the default deployed state of the application. The limiting factor is that Apache JSPWiki has a relatively niche deployment footprint compared to mainstream web platforms, reducing the total addressable attack surface. The actual sensitivity of exfiltrated data depends on what the application stores in debug context at runtime, which varies by deployment. Inward-facing or intranet-only deployments are substantially protected by network segmentation.

The CVSS base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N characterizes this as a high-severity, trivially exploitable, unauthenticated remote information disclosure. However, several signals substantially moderate the operational urgency: EPSS is 0.17% at the 7th percentile, indicating that empirical exploitation data shows nearly no observed exploitation attempts in the wild; the vulnerability is not listed in CISA KEV; and no POC has been identified. This creates a notable divergence between the CVSS severity signal and real-world exploitation likelihood. The C:H impact rating is contingent on the actual sensitivity of data present in debug messages, which varies by deployment configuration. This is a genuine priority for JSPWiki operators but does not represent an immediate mass-exploitation threat. CVSS and EPSS signals conflict - prioritize patching during the next maintenance window rather than treating it as an emergency.

An unauthenticated attacker sends a specially crafted HTTP request to a publicly accessible JSPWiki instance running version 2.12.3 or earlier, triggering an application error or debug code path that returns verbose diagnostic output in the HTTP response. The response may include internal file paths, configuration parameters, session-related data, or other sensitive runtime information that the attacker can harvest to inform further targeted attacks against the application or underlying infrastructure. No public exploit code has been identified at time of analysis, so exploitation would currently require manual discovery of the triggering request.