What is the CVSS score of CVE-2026-40985?

CVE-2026-40985 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40985?

Yes, a patch is available for CVE-2026-40985. Update the affected software to the latest version immediately.

Spring Web Flow CVE-2026-40985

EUVD-2026-36200 MEDIUM

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-06-11 vmware

GHSA-9ggw-87m9-9gfc

Java Information Disclosure Spring Web Flow

6.4

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.4 MEDIUM

Non-default WebFlowELExpressionParser configuration drives AC:H; authenticated low-privilege access and required user interaction are independently confirmed by CVSS PR:L and UI:R; no availability impact per description.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 06:01 EUVD

Analysis Generated

Jun 11, 2026 - 05:26 vuln.today

DescriptionCVE.org

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.

Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

AnalysisAI

Expression Language Injection in Spring Web Flow exposes applications explicitly configured with WebFlowELExpressionParser to evaluation of malicious Unified EL expressions submitted by authenticated low-privilege users. Affected versions span the 2.5.x, 3.0.x, and 4.0.0 release lines; exploitation requires both non-default configuration and user interaction, which meaningfully constrains real-world risk despite the High confidentiality and integrity impact ratings. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Spring Web Flow (cpe:2.3:a:spring:spring_web_flow:*:*:*:*:*:*:*:*) is a Java framework built on Spring MVC that manages stateful, multi-step web application flows. The WebFlowELExpressionParser is an optional component that integrates the Java Unified Expression Language (EL) engine to evaluate expressions during flow execution - used for binding, validation, navigation decisions, and model access. CWE-917 (Expression Language Injection) describes the root cause: user-controlled input reaches an EL evaluator without adequate sanitization, allowing an attacker-supplied string to be interpreted as executable EL rather than literal data. This class of vulnerability is historically significant in the Spring ecosystem (cf. Spring Framework EL injection issues) and can expose server-side object graphs, invoke arbitrary Java methods available on the EL context, or alter application state depending on what objects are bound to the EL context at the time of evaluation.

RemediationAI

Consult the vendor advisory at https://spring.io/security/cve-2026-40985 for the exact patched release versions, as specific fix version numbers were not included in the available intelligence data and should not be inferred. The primary fix is upgrading to a patched release of Spring Web Flow once published by VMware/Broadcom. As an immediate compensating control, teams that do not require Unified EL expression evaluation should remove or replace the WebFlowELExpressionParser configuration - this eliminates the vulnerable code path entirely and carries minimal functional impact for applications not relying on this parser. Applications that must retain EL expression evaluation should enforce strict input validation and allowlisting on any user-supplied strings that could enter the EL evaluation context, and should restrict access to affected flow endpoints to authenticated, trusted users where possible. The UI:R requirement suggests that restricting who can trigger the relevant flow transitions may further limit exposure.