What is the CVSS score of CVE-2026-40986?

CVE-2026-40986 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40986?

Yes, a patch is available for CVE-2026-40986. Update the affected software to the latest version immediately.

Spring Web Flow CVE-2026-40986

EUVD-2026-36201 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-11 vmware

GHSA-hw5c-xm3c-v96w

Java XSS Spring Web Flow

4.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

4.8 MEDIUM

Network-reachable RemotingHandler requires low-privilege auth (PR:L), attacker must engineer reflected error content (AC:H), victim interaction required (UI:R); XSS yields integrity-only impact with no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:07 vuln.today

DescriptionCVE.org

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker.

Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

AnalysisAI

Reflected XSS in Spring Web Flow's JavaScript RemotingHandler allows an authenticated attacker to inject and execute arbitrary scripts in a victim's browser by embedding malicious content in input that the server reflects within error response bodies. The RemotingHandler renders these error bodies as HTML regardless of the declared Content-Type, bypassing MIME-type enforcement. Affected versions span the 2.5.x, 3.0.x, and 4.0.0 release lines; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Spring Web Flow is a Spring Framework extension for orchestrating multi-step stateful web workflows. Its JavaScript RemotingHandler provides server-side AJAX/remoting support for workflow transitions triggered by browser-side JavaScript. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): the handler fails to enforce content-type boundaries when constructing error responses, treating the response body as renderable HTML in the browser even when the HTTP Content-Type header declares a non-HTML media type. If server-generated error details echo back attacker-controlled input (e.g., from form fields, path parameters, or query strings that surface in exception or validation messages), that content is injected into the DOM without sanitization. The CPE cpe:2.3:a:spring:spring_web_flow:*:*:*:*:*:*:*:* covers the Spring Web Flow component published by the Spring (VMware/Broadcom) project.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in the Spring security advisory at https://spring.io/security/cve-2026-40986; the exact fixed version number is not present in available intelligence and must be confirmed directly from that advisory before upgrading. As a compensating control while patching is scheduled, deploy a Content Security Policy (CSP) response header (e.g., default-src 'self'; script-src 'self') to block inline script execution in the browser - note this may require updating application JavaScript to eliminate inline handlers and eval() usage, which carries development overhead. Additionally, configure server-side output encoding for any user-supplied data that may appear in error messages returned by RemotingHandler endpoints; Spring's HtmlUtils.htmlEscape() or equivalent can be applied at the error-generation layer. Restricting authenticated access to RemotingHandler endpoints to the minimum necessary user population reduces the attacker pool consistent with PR:L.