What is the CVSS score of CVE-2026-40973?

CVE-2026-40973 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Boot are affected by CVE-2026-40973?

Spring Boot versions 2.7.0 through 4.0.5 contain a local privilege escalation vulnerability that enables attackers with local system access to hijack authenticated user sessions or execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-40973?

Within 24 hours: Identify all Spring Boot deployments and document versions running 2.7.0-4.0.5 with server.servlet.session.persistent enabled. Within 7 days: Apply vendor patches (Spring Boot 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33 depending on your version branch) and test in staging environments. Within 30 days: Complete production deployment of patched versions across all affected systems and verify session storage configuration compliance.

Spring Boot CVE-2026-40973

HIGH

Insecure Temporary File (CWE-377)

2026-04-28 security@vmware.com

GHSA-wwpq-f5c3-7hvx

Information Disclosure Java Red Hat

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 00:30 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

HIGH 7.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,921 maven packages depend on org.springframework.boot:spring-boot (120 direct, 1,801 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.

Affected: Spring Boot 4.0.0-4.0.5 (fix 4.0.6), 3.5.0-3.5.13 (fix 3.5.14), 3.4.0-3.4.15 (fix 3.4.16), 3.3.0-3.3.18 (fix 3.3.19), 2.7.0-2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.

AnalysisAI

Local privilege escalation and session hijacking in Spring Boot allows attackers with local access to hijack authenticated sessions or execute arbitrary code by taking control of the ApplicationTemp directory. The vulnerability affects Spring Boot versions 2.7.0 through 4.0.5 when server.servlet.session.persistent is enabled, requiring attack persistence across application restarts. VMware has released patches for all supported branches (4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33), though unsupported versions remain vulnerable. No active exploitation confirmed at time of analysis.

Technical ContextAI

Spring Boot's ApplicationTemp directory is used for temporary file operations and session persistence when server.servlet.session.persistent is configured. The vulnerability stems from CWE-377 (Insecure Temporary File), indicating predictable directory paths and inadequate ownership verification. A local attacker can exploit race conditions or predictable naming patterns to substitute the ApplicationTemp directory with their own controlled location. When persistent sessions are enabled, Spring Boot serializes session objects to this directory across application restarts. By controlling this directory, an attacker can inject malicious serialized objects (gadget chain attacks in Java deserialization contexts) or read existing session files containing authentication tokens, session IDs, and user state. The attack requires low privileges (PR:L) but high attack complexity (AC:H), suggesting timing dependencies or specific system conditions must align. The vulnerability spans multiple Spring Boot major versions from 2.7.x through 4.0.x, indicating a long-standing architectural issue in temporary directory handling.

RemediationAI

Upgrade to patched Spring Boot versions immediately: 4.0.6 or later for 4.0.x branch, 3.5.14 or later for 3.5.x, 3.4.16 or later for 3.4.x, 3.3.19 or later for 3.3.x, or 2.7.33 or later for 2.7.x deployments. Download patches and review complete upgrade guidance at https://spring.io/security/cve-2026-40973. For systems that cannot immediately upgrade, disable persistent sessions by setting server.servlet.session.persistent to false in application.properties or application.yml, which eliminates the attack vector but will cause session loss across application restarts, affecting user experience in maintenance scenarios. As an additional defense layer, restrict local user access to application servers through operating system access controls, implement mandatory access control (MAC) policies like SELinux or AppArmor to confine the Spring Boot process and prevent directory manipulation by other local users, and monitor ApplicationTemp directory ownership and permissions for unexpected changes through file integrity monitoring tools. Organizations running unsupported Spring Boot versions must prioritize migration to supported branches or accept residual risk with compensating controls, as no vendor patches will be provided.