CVE-2026-40976
criticalpriority · track · 10OT risk · elevatedEPSS 0.005 · 45 %ileexploit · PoCDEEUFRNLUSEPSS · scored 2026-10-22
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- madebyrokit/CVE-2026-40976-POCmadebyrokit/CVE-2026-40976-POCPoC · poc_in_github
affected products (49)
Products and version ranges known to be affected.
- Oracle Financial Services Applications 14.5.0-14.8.0all versionscert_bundDEcpe:/a:oracle:financial_services_applications:14.5.0-14.8.0
- Oracle Financial Services Applications 8.0.7.9.0all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.0.7.9.0
- Oracle Financial Services Applications 8.0.8.7.0all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.0.8.7.0
- Oracle Financial Services Applications 8.1.2.5.0all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.1.2.5.0
- Oracle Financial Services Applications 8.1.2.7all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.1.2.7
- Oracle Financial Services Applications 8.1.2.9all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.1.2.9
- Oracle Financial Services Applications 8.1.3.0all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.1.3.0
- Oracle Financial Services Applications 8.1.3.1all versionscert_bundDEcpe:/a:oracle:financial_services_applications:8.1.3.1
- Red Hat Enterprise Linux Apache Camel for Spring Bootall versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot
advisories (8)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0256Kwetsbaarheden verholpen in Oracle CommunicationsNL2026-07-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Communications producten en onderliggende third party software. Het betreft een totaal van 213 kwetsbaarheden, waarvan 67 zich bevinden in Oracle producten en 146 in third-party producten waar eerder updates voor zijn verschenen en welke in deze Oracle updates zijn verwerkt.
- NCSC-2026-0258Kwetsbaarheden verholpen in Oracle Financial ServicesNL2026-07-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Financial Services modules. Ook heeft Oracle updates voor diverse third-party-producten verwerkt.
- WID-SEC-W-2026-1263VMware Tanzu Spring Boot: Mehrere SchwachstellenDeutsch2026-04-23csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Boot ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Daten zu manipulieren oder offenzulegen oder authentifizierte Benutzer zu kapern.
- WID-SEC-W-2026-2260IBM Operational Decision Manager: Mehrere SchwachstellenDeutsch2026-07-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2026-2437Oracle Communications: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2026-2445Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-8v8j-3hxp-93wrSpring Boot's default security filter chain has no authorization rule with Actuator but without Health2026-04-28ghsa · osvUS
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
- CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2026-40976cnnvd
- https://spring.io/security/cve-2026-40976Patchcnnvd
- https://spring.io/security/cve-2026-40976enisa_euvd
- https://access.redhat.com/security/cve/CVE-2026-40976nvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2463322nvd
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40976.jsonnvd
- https://spring.io/security/cve-2026-40976Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan