CVE-2026-44179: RCE in XWiki Remote Macros, urgent upgrade to 1.14.5

CVE-2026-44179 describes a syntax injection flaw in XWiki Remote Macros, specifically within the excerpt-include macro. The macro fails to properly escape the included page's title and executes excerpt content with the macro's own rights. This allows any page editor, even without script or programming permissions, to inject executable macro syntax and achieve RCE (remote code execution) with the privileges of the XWiki installation.

The vulnerability carries a CVSS 9.9 (Critical) score. It was published by NVD on October 28, 2026: less than 48 hours ago. Four public posts on X in the past 24 hours reported consistent analysis of the severity. No confirmed publicly available exploitation or published exploit has been documented, but the straightforward nature of the flaw demands immediate action.

For defenders, the priority action is to upgrade XWiki Remote Macros to version 1.14.5 or later. Before upgrading, identify all XWiki installations that include the Remote Macros component. After patching, audit change logs for the vulnerable period (from deployment of version 1.13 to present) to detect any syntax injections in page titles or excerpt fields.