[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5CI74ZsKzzH6bEETy7bd87tf3lv848cyltsazJV88ls":3,"g5a-risk:CVE-2026-89238":121},{"success":4,"data":5,"meta":118},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":33,"epssPercentile":27,"epssTimeSeries":34,"severity":35,"affectedProducts":36,"affectedProductsCount":42,"references":43,"referencesCount":55,"weaknesses":56,"weaknessesCount":42,"isActivelyExploited":65,"cisaInfo":27,"otxData":27,"relatedBlogPosts":66,"seoMetadata":67,"configurations":92,"relatedVendorCves":109,"notableEvents":110},"CVE-2026-89238","What is CVE-2026-89238?","WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.\nUsers are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.","WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality co...","2026-09-30T13:17:21.587","2026-10-06T17:26:05.287",9.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":30,"CVSSMetricV2":31,"CVSSMetricV40":32},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"134c704f-9b21-4f2e-91b3-4a467353bcc0","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.2,[],[],[],0.00266,[33,33,33,33,33,33,33],"Critical",[37],{"vendor":38,"product":39,"version":40,"criteria":41,"vulnerable":4},"apache","wss4j","*","cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:*",1,[44,50],{"url":45,"source":46,"tags":47},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002F1lv4hpl8kon1ns5txjnhn2m2sh9rl22w","Apache",[48,49],"Vendor Advisory","Mailing List",{"url":51,"source":52,"tags":53},"http:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F09\u002F30\u002F11","Openwall",[49,54],"Third Party Advisory",2,[57],{"id":58,"name":59,"description":60,"extendedDescription":61,"status":62,"abstraction":63,"structure":64},"CWE-345","Insufficient Verification of Data Authenticity","The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.","","Draft","Class","Simple",false,[],{"title":68,"metaDescription":69,"keywords":70,"canonicalUrl":71,"structuredData":72},"What is CVE-2026-89238? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2026-89238, a critical severity cyber security vulnerability from 2026. WSS4J EncryptedHeader child confusion could promote an ...","CVE-2026-89238, CVE-2026-89238 vulnerability, CVE-2026-89238 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, apache security, wss4j vulnerability","\u002Fwhat-is\u002Fcve-2026-89238",{"@context":73,"@type":74,"headline":68,"description":69,"datePublished":10,"dateModified":11,"author":75,"publisher":79,"about":83,"mainEntityOfPage":87,"articleSection":90,"keywords":91},"https:\u002F\u002Fschema.org","TechArticle",{"@type":76,"name":77,"url":78},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":76,"name":77,"url":78,"logo":80},{"@type":81,"url":82},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":84,"name":6,"description":85,"additionalType":86},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":88,"@id":89},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2026-89238","Cybersecurity","CVE-2026-89238, CVE-2026-89238 vulnerability, CVE-2026-89238 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[93],{"Operator":27,"Negate":27,"Nodes":94},[95],{"Operator":96,"Negate":65,"CPEMatch":97},"OR",[98,101,105],{"Vulnerable":4,"Criteria":41,"MatchCriteriaID":99,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":100,"VersionEndIncluding":27},"A3409718-5467-407D-9B51-14E58B6D2F68","2.4.4",{"Vulnerable":4,"Criteria":41,"MatchCriteriaID":102,"VersionStartExcluding":27,"VersionStartIncluding":103,"VersionEndExcluding":104,"VersionEndIncluding":27},"31AFF243-7BCE-44BC-85C5-6FE257642C13","3.0.0","3.0.6",{"Vulnerable":4,"Criteria":41,"MatchCriteriaID":106,"VersionStartExcluding":27,"VersionStartIncluding":107,"VersionEndExcluding":108,"VersionEndIncluding":27},"20E76C98-444D-4DB5-91E0-90E84C196158","4.0.0","4.0.2",[],[111],{"id":112,"eventType":113,"eventTime":114,"details":115,"label":116,"color":117},"cc130a36-0623-4414-9ea7-847102e24f0f","NEW_NVD","2026-10-01T04:01:46.778851+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":119,"version":120},1792248927875,"2.0",{"score":122,"band":123,"action":124,"scoredAt":125},54,"Medium","Plan remediation","2026-10-16T07:18:19.691838+00:00"]