CVE-2026-40994

highpriority · track · 0OT risk · elevatedEPSS 0.002 · 14 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.23% (14th) EPSS

CVSS 8.2 · high

Is it mine?

12 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

cvss

Technical severity, 0–10. One row per scoring source.

8.2

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Nsecondary · ENISA EU

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Nsecondary · security@vmware.comexploitability 3.9 · impact 4.2

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Nsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1188USCWE-1188US

affected products (12)

Products and version ranges known to be affected.

Spring Spring Web Services3.1.0 → 3.1.9enisa_euvdEU
Spring Spring Web Services4.0.0 → 4.0.19enisa_euvdEU
Spring Spring Web Services4.1.0 → 4.1.3.1enisa_euvdEU
Spring Spring Web Services5.0.0 → 5.0.1.1enisa_euvdEU
broadcom spring web services< 3.1.9nvdUScpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*
broadcom spring web services4.0.0 → 4.0.19nvdUScpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*
broadcom spring web services4.1.0 → 4.1.3.1nvdUScpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*
broadcom spring web services5.0.0 → 5.0.1.1nvdUScpe:2.3:a:broadcom:spring_web_services:*:*:*:*:*:*:*:*
Maven org.springframework.ws:spring-ws-security3.1.0 → 3.1.8osvUSpkg:maven/org.springframework.ws/spring-ws-security
Maven org.springframework.ws:spring-ws-security4.0.0 → 4.0.18osvUSpkg:maven/org.springframework.ws/spring-ws-security
Maven org.springframework.ws:spring-ws-security4.1.0 → 4.1.4osvUSpkg:maven/org.springframework.ws/spring-ws-security
Maven org.springframework.ws:spring-ws-security5.0.0 → 5.0.2osvUSpkg:maven/org.springframework.ws/spring-ws-security

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-gg9r-wr4p-w63hSpring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default2026-06-11ghsa · osvUS
Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2026-06-11modified 2026-09-04

references (4)

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2026-40994 cnnvd
https://spring.io/security/cve-2026-40994Patchcnnvd
https://spring.io/security/cve-2026-40994 enisa_euvd
https://spring.io/security/cve-2026-40994Vendor AdvisoryMitigationnvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan