What is the CVSS score of CVE-2026-66391?

CVE-2026-66391 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Apache Wicket CVE-2026-66391

EUVD-2026-49368 MEDIUM

Use of Insufficiently Random Values (CWE-330)

2026-07-27 apache

GHSA-r3h3-mj63-mm3p

Apache Information Disclosure Apache Wicket

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 27, 2026 - 18:22 NVD

6.5 (MEDIUM)

Analysis Generated

Jul 27, 2026 - 17:32 vuln.today

CVE Published

Jul 27, 2026 - 16:45 cve.org

HIGH

CVE Published

Jul 27, 2026 - 16:45 cve.org

MEDIUM 6.5

DescriptionCVE.org

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.

Users are recommended to upgrade to version 10.10.0, which fixes the issue.

AnalysisAI

Unauthenticated remote attackers can partially read and modify data in Apache Wicket versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0 due to a protection mechanism that relies on insufficiently random values. The vulnerability is automatable with low attack complexity and no user interaction, though no active exploitation or public exploit code has been observed at this time. While the technical impact is limited to partial confidentiality and integrity compromise, the widespread enterprise use of Wicket makes it a moderate priority for patching.