CVE-2026-44179: Critical RCE in XWiki Pro Macros via Excerpt-Include Macro (CVSS 9.9)

Vulnerability Overview

CVE-2026-44179 is a critical remote code execution vulnerability (CVSS 9.9) affecting the com.xwiki.pro:xwiki-pro-macros package. Classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), the root cause is a server-side template injection flaw in the excerpt-include macro. When XWiki processes page titles or content through this macro, it fails to sanitize script expressions before evaluation — allowing injected Groovy or Velocity directives to execute in the context of the server process. The impact is full server compromise: arbitrary code execution with the privileges of the XWiki application user, with no authentication required in the worst-case scenario.

Affected Software

The vulnerability affects the Maven artifact com.xwiki.pro:xwiki-pro-macros in versions >= 1.13 and < 1.14.5. Deployments running any release in that range are exposed. At the time of writing, no patched release date has been confirmed, making rapid detection and compensating controls the primary defensive lever.

Exploitation Status

A public proof-of-concept is available for CVE-2026-44179, disclosed on 22 June 2026. This materially lowers the bar for exploitation: opportunistic threat actors can weaponize the PoC without deep XWiki internals knowledge. Defenders should treat this as actively exploitable and prioritise detection coverage and patch verification immediately. The combination of a 9.9 CVSS score, unauthenticated attack surface, and public PoC makes this a high-priority item for any organisation running XWiki Pro.

How Our Detection Catches It

Our detection package ships query coverage across seven SIEM platforms, giving defenders visibility regardless of their logging stack:

• Microsoft Sentinel (KQL) — correlates XWiki application logs and web access logs for script expression patterns ($, #, Groovy class-loading signatures) appearing in page title fields or macro invocation parameters, flagging requests that trigger the excerpt-include evaluation path.
• Splunk (SPL) — searches web and application event sources for anomalous macro rendering events combined with server-side exception traces indicative of injected expression evaluation.
• Elastic EQL — uses event sequence logic to chain an inbound HTTP write to XWiki content endpoints with downstream process execution or outbound network calls spawned by the JVM, catching post-exploitation activity.
• IBM QRadar (AQL) — queries application log flows for CWE-95-class payloads in XWiki request parameters, cross-referenced against the affected version range.
• Sumo Logic — log search rules targeting Groovy/Velocity injection tokens in XWiki audit and access logs.
• Chronicle YARA-L — rule matching on UDM events for suspicious script expression tokens in HTTP POST bodies directed at XWiki content APIs.
• CrowdStrike (CQL) — endpoint-level detection watching for JVM child process spawns and unusual network egress originating from the XWiki application process, covering post-exploitation behaviour when log-level visibility is limited.

The detection logic focuses on two complementary signal layers: input-side (malicious expressions entering XWiki content) and execution-side (anomalous JVM behaviour following macro evaluation), reducing both false-negative and false-positive rates.

Next Steps for Defenders

Upgrade com.xwiki.pro:xwiki-pro-macros to version 1.14.5 or later as soon as a patch is available, and restrict write access to XWiki pages to trusted users in the interim. For full detection query text, MITRE ATT&CK mapping, atomic test cases, and purple team playbooks, visit the CVE-2026-44179 detection page.