VMware Spring Boot vulnerabilities

20 CVEs affecting VMware Spring Boot, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41001, published 2026-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-8046, published 2018-01-04. Critical severity, CVSS 9.8. EPSS: 74.5% chance of exploitation in the next 30 days. Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use…
CVE-2021-26987, published 2021-03-15. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to…
CVE-2023-22602, published 2023-01-14. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot…
CVE-2023-34055, published 2023-11-28. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…
CVE-2018-1196, published 2018-03-19. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1…
CVE-2023-20873, published 2023-04-20. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected…
CVE-2023-20883, published 2023-05-26. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used…
CVE-2022-27772, published 2022-03-30. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the…
CVE-2026-40976, published 2026-04-28. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web…
CVE-2026-40975, published 2026-04-28. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values…

Latest

CVE-2026-41001, published 2026-06-11. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same…
CVE-2026-40992, published 2026-06-11. Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days. Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as…
CVE-2026-40977, published 2026-04-28. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is…
CVE-2026-40974, published 2026-04-28. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix…
CVE-2026-40973, published 2026-04-28. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack…
CVE-2026-40972, published 2026-04-28. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the…
CVE-2026-40971, published 2026-04-27. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix…
CVE-2026-40970, published 2026-04-27. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot…