Medium severity · published Jun 11, 2026
CVE-2026-40997
SOAP security faults leak Spring Security account state
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Spring Web Services · Spring
5.0.0 before 5.0.1.1; 4.1.0 before 4.1.3.1; 4.0.0 before 4.0.19; 3.1.0 before 3.1.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40997
Vendor Advisory
https://spring.io/security/cve-2026-40997
More from Spring Web Services
9.8
CVE-2019-3773
Spring Web Services XML External Entity Injection (XXE)
8.6
CVE-2026-40999
Spring WS SSRF via unvalidated WS-Addressing reply destinations
8.2
CVE-2026-40998
Jaxp13 XPath XXE via StreamSource and SAXSource
8.2
CVE-2026-40994
Wss4jSecurityInterceptor disables WS-I BSP validation by default
5.4
CVE-2026-40995
X.509 authentication bypasses Spring Security account checks