What is the CVSS score of CVE-2025-41232?

CVE-2025-41232 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Java are affected by CVE-2025-41232?

CVE-2025-41232 presents critical security risk, a protection bypass vulnerability rated CVSS 9.1.. A patch is available.

How to fix or mitigate CVE-2025-41232?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Java CVE-2025-41232

CRITICAL

Protection Mechanism Failure (CWE-693)

2025-05-21 security@vmware.com

Authentication Bypass Java Spring Red Hat

Critical

Disputed · 9.1 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Red Hat

7.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:43 vuln.today

CVE Published

May 21, 2025 - 12:16 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

27 maven packages depend on org.springframework.security:spring-security-core (19 direct, 8 indirect)

Ecosystem-wide dependent count for version 6.4.0.

DescriptionCVE.org

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
You have Spring Security method annotations on a private method

In that case, the target method may be able to be invoked without proper authorization.

You are not affected if:

You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
You have no Spring Security-annotated private methods

AnalysisAI

Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-693. Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: * You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and * You have Spring Security method annotations on a private method In that case, the target method may be able to be invoked without proper authorization. You are not affected if: * You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or * You have no Spring Security-annotated private methods

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.