Cross-Site Scripting Vulnerability in Apache Sling XSS
CVE-2026-91999

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Sling Xss
Vendor: CVE Published:; 23 September 2026

What is CVE-2026-91999?

A cross-site scripting vulnerability exists in Apache Sling XSS prior to version 2.4.12. This issue arises due to improper neutralization of user input during web page generation, allowing attackers to inject malicious scripts into web pages viewed by end users. Exploitation of this vulnerability could result in unauthorized access to sensitive information or session hijacking. Users are strongly advised to update to version 2.4.12 to remediate this security flaw.

Affected Version(s)

Apache Sling XSS 0 < 2.4.12

References

https://lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhz...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 23, 2026
Vulnerability Reserved
Sep 15, 2026

Credit

The Apache Software Foundation

Claude Code

CVE-2026-91999 Data

JSON