CVE-2026-40972 Spring CVE debrief

Who should care

Security teams and administrators responsible for VMware Spring Boot deployments should prioritize patching this vulnerability to prevent potential remote code execution attacks. This includes reviewing the affected versions, assessing the risk, and applying patches or mitigations as necessary. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability, CVE-2026-40972, is caused by a timing attack vulnerability in the DevTools remote secret comparison feature of VMware Spring Boot. An attacker on the same network as the remote application may be able to utilize this vulnerability to discover information about the remote secret. In extreme circumstances, this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32.

Defensive priority

High

Recommended defensive actions

• Apply patches for affected Spring Boot versions: 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33
• Inventory and update vulnerable Spring Boot deployments
• Implement compensating controls, such as network segmentation and monitoring
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record was published on 2026-04-28T00:16:24.210Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32. There may be additional details in the vendor advisory or other sources that provide further context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.