CVE-2026-40010
Published: 06 May 2026
Summary
CVE-2026-40010 is a critical-severity Session Fixation (CWE-384) vulnerability in Apache Wicket. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.
Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.
Enforces proper session ID generation and binding, preventing fixation of a known session token.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Session fixation vuln in public web framework directly enables T1190 exploitation and T1185 browser session hijacking via fixed session IDs.
NVD Description
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended…
more
to upgrade to version 10.9.0, which fixes the issue.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)