CVE-2026-91852
📛 CVE Title
Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- apache
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 6.1 / 10 MEDIUM source: NVD
- CWE(s)
-
CWE-79 - Reserved
- 2026-09-15
- Published
- 2026-09-23 09:29 UTC
- Last updated
- 2026-09-23 17:08 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91852.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 10:17:07 UTC
- NVD last modified
- 2026-09-23 17:58:26 UTC
- NVD CVSS v3.1
- 6.1 / 10 MEDIUM source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 2.7 / 10
- EPSS score
- 0.0021 (probability of exploitation in next 30 days)
- EPSS percentile
- 11.85% vs all CVEs — higher = more likely to be exploited, as of 2026-09-23
NVD / KEV / EPSS data refreshed 2026-09-24 04:29 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85176 - Assigner
- apache
- Published
- Sep 23, 2026, 9:29:11 AM
- Updated
- Sep 23, 2026, 5:08:12 PM
- EUVD base score (CVSS 3.1)
-
6.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EUVD-reported EPSS
- 0.2100
- Vendors
- Apache Software Foundation
- Products
-
Apache Sling XSS (0 <2.4.12)
- Aliases
-
GHSA-j583-7q6g-jm53
ENISA description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
0 (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
- https://sling.apache.org/news.html vendor-advisory
- https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo vendor-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- http://www.openwall.com/lists/oss-security/2026/09/23/12 af854a3a-2127-422b-91ae-364da2661108
- https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo security@apache.org
- https://sling.apache.org/news.html security@apache.org
Remediations (10)
-
web:forkast.news
With over 13,000 internet-exposed Check Point VPN devices identified globally as of June 2024, the window for effective remediation is closing rapidly. Organizations that have not applied the September 9 patches are now operating in a state of active compromise risk.
2026-09-24 11:47 UTC -
web:github.com
Moderate severity Unreviewed Published Sep 23, 2026 to the GitHub Advisory Database • Updated Sep 23, 2026
2026-09-24 11:47 UTC -
web:learn.microsoft.com
In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort to help you manage security risks and help keep your systems protected. Please use the ...
2026-09-24 11:47 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-09-24 11:47 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:47 UTC -
web:support.microsoft.com
This update for Windows 11, version 25H2 and 24H2 (KB5084597) incudes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To view the ...
2026-09-24 11:47 UTC -
web:tech-insider.org
A 12-year-old CryptoJS function ( CVE - 2026 -71851, CVSS 9.0) used weak randomness for wallet keys. Attackers drained $5.7M before patches landed.
2026-09-24 11:47 UTC -
web:vulners.com
The Apache Sling XSS component (versions before 2.4.12 ) is vulnerable to a cross-site scripting (XSS) flaw caused by the improper neutralization of input during web page generation . This vulnerability allows for potential impact on confidentiali...
2026-09-24 11:47 UTC -
web:www.rapid7.com
CVE-2026-91852 : Apache Software Foundation Apache Sling XSS: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. View severity, references, and remediation details from Rapid7.
2026-09-24 11:47 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-09-24 11:47 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-91852.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:04:21.554097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:04:40.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:12.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apache Sling would like to thank the github user n0mi1k, the group of Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat, Ali Javidi Ghasr and Mohammad A. Tayebi and The Apache Software Foundation for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.</p><p>This issue affects Apache Sling XSS: before 2.4.12.</p><p>Users are recommended to upgrade to version 2.4.12, which fixes the issue.</p>"
}
],
"value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:29:11.099Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://sling.apache.org/news.html"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo"
}
],
"source": {
"defect": [
"https://issues.apache.org/jira/browse/SLING-13334"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91852",
"datePublished": "2026-09-23T09:29:11.099Z",
"dateReserved": "2026-09-15T08:57:35.201Z",
"dateUpdated": "2026-09-23T17:08:12.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}