PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40972 Spring CVE debrief

CVE-2026-40972 is a high-severity vulnerability in VMware Spring Boot that allows an attacker to discover the remote secret via a timing attack, potentially leading to remote code execution. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32. This vulnerability is caused by a timing attack vulnerability in the DevTools remote secret comparison feature of VMware Spring Boot. An attacker on the same network as the remote application may be able to utilize this vulnerability to discover information about the remote secret. In extreme circumstances, this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Vendor
Spring
Product
Spring Boot
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-28
Original CVE updated
2026-07-24
Advisory published
2026-04-28
Advisory updated
2026-07-24

Who should care

Security teams and administrators responsible for VMware Spring Boot deployments should prioritize patching this vulnerability to prevent potential remote code execution attacks. This includes reviewing the affected versions, assessing the risk, and applying patches or mitigations as necessary. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability, CVE-2026-40972, is caused by a timing attack vulnerability in the DevTools remote secret comparison feature of VMware Spring Boot. An attacker on the same network as the remote application may be able to utilize this vulnerability to discover information about the remote secret. In extreme circumstances, this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32.

Defensive priority

High

Recommended defensive actions

  • Apply patches for affected Spring Boot versions: 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33
  • Inventory and update vulnerable Spring Boot deployments
  • Implement compensating controls, such as network segmentation and monitoring
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record was published on 2026-04-28T00:16:24.210Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32. There may be additional details in the vendor advisory or other sources that provide further context.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-28T00:16:24.210Z and has not been modified since then. The NVD entry is currently Analyzed.