CVE-2026-89238

Summary

The flaw in WSS4J allows an attacker to confuse the EncryptedHeader, promoting an attacker-controlled plaintext element as the decrypted header, leading to potential policy bypass and loss of confidentiality.

Exploitability

Exploitation requires knowledge of the specific WSS4J implementation and access to the affected endpoint. Precondition is the presence of the vulnerable version of WSS4J in the system.

Blast radius

If exploited, this could lead to unauthorized access and data exposure, impacting the confidentiality of the system's communications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WSS4J version 4.0.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.