CVE-2026-41853

mediumpriority · track · 0EPSS 0.002 · 8 %ileDEEUFRUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.19% (8th) EPSS

CVSS 5.3 · medium

Is it mine?

19 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · security@vmware.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-444USCWE-444US

affected products (19)

Products and version ranges known to be affected.

Siebel CRMall versionscert_bundDEcpe:/a:oracle:siebel_crm:22.3-26.9
Siebel CRMall versionscert_bundDEcpe:/a:oracle:siebel_crm:25.12-26.9
Siebel CRMall versionscert_bundDEcpe:/a:oracle:siebel_crm:17.0-26.9
Spring Spring Framework5.3.0 → 5.3.49enisa_euvdEU
Spring Spring Framework6.1.0 → 6.1.28enisa_euvdEU
Spring Spring Framework6.2.0 → 6.2.18.1enisa_euvdEU
Spring Spring Framework7.0.0 → 7.0.7.1enisa_euvdEU
vmware spring framework5.3.0 → 5.3.49nvdUScpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
vmware spring framework6.1.0 → 6.1.28nvdUScpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
vmware spring framework6.2.0 → 6.2.18.1nvdUScpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
vmware spring framework7.0.0 → 7.0.7.1nvdUScpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Maven org.springframework:spring-webflux≤ 5.3.39osvUSpkg:maven/org.springframework/spring-webflux
Maven org.springframework:spring-webflux6.1.0 → 6.1.21osvUSpkg:maven/org.springframework/spring-webflux
Maven org.springframework:spring-webflux6.2.0 → 6.2.19osvUSpkg:maven/org.springframework/spring-webflux
Maven org.springframework:spring-webflux7.0.0 → 7.0.8osvUSpkg:maven/org.springframework/spring-webflux
Maven org.springframework:spring-webmvc≤ 5.3.39osvUSpkg:maven/org.springframework/spring-webmvc
Maven org.springframework:spring-webmvc6.1.0 → 6.1.21osvUSpkg:maven/org.springframework/spring-webmvc
Maven org.springframework:spring-webmvc6.2.0 → 6.2.19osvUSpkg:maven/org.springframework/spring-webmvc
Maven org.springframework:spring-webmvc7.0.0 → 7.0.8osvUSpkg:maven/org.springframework/spring-webmvc

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1828VMware Tanzu Spring Framework: Mehrere SchwachstellenDeutsch2026-06-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, sensible Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting- und Open-Redirect-Angriffe durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.
WID-SEC-W-2026-4084Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-cjpg-rgq5-fr37Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux2026-06-09ghsa · osvUS
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
CERTFR-2026-AVI-1355Multiples vulnérabilités dans Oracle WeblogicFrançais2026-10-21vendor · certfrFR
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv certfr NVD CVE.org MITRE

published 2026-06-09modified 2026-07-23

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan