What is the CVSS score of CVE-2026-40993?

CVE-2026-40993 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Security are affected by CVE-2026-40993?

Spring Security 7.0.0-7.0.5 contains a code execution vulnerability in JDBC-backed SAML 2.0 metadata storage that exposes organizations to application compromise if database write access is…. A patch is available.

How to fix or mitigate CVE-2026-40993?

24 hours: Inventory all deployments running Spring Security 7.0.0-7.0.5 with JDBC SAML 2.0 repository. 7 days: Apply patch available per vendor advisory to all affected systems. 30 days: Validate SAML authentication functionality post-patch and review database access controls to ensure least-privilege restrictions on saml2_asserting_party_metadata table.

Spring Security CVE-2026-40993

EUVD-2026-35886 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-10 security@vmware.com

GHSA-2q7c-5gjm-7q23

Deserialization Java Spring Security

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Requires high-privilege DB write access (PR:H), no user interaction, and successful deserialization yields full RCE in the application JVM, so C/I/A all High.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 03:49 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 03:49 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 03:38 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 03:38 NVD

7.3 (HIGH) 7.2 (HIGH)

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.springframework.security:spring-security-saml2-service-provider (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).

Affected versions: Spring Security 7.0.0 through 7.0.5.

AnalysisAI

Insecure deserialization in Spring Security 7.0.0 through 7.0.5 allows an attacker with write access to the saml2_asserting_party_metadata database table to store malicious serialized Java payloads in the verification_credentials or encryption_credentials columns, leading to code execution when the JdbcAssertingPartyMetadataRepository deserializes them. The flaw affects deployments using the JDBC-backed SAML 2.0 asserting-party metadata repository introduced in the Spring Security 7.x line. No public exploit identified at time of analysis and EPSS is very low (0.01%), but CVSS rates impact as High due to full confidentiality, integrity, and availability loss on the application.

Technical ContextAI

Spring Security's JdbcAssertingPartyMetadataRepository persists SAML 2.0 Relying Party / Asserting Party metadata, including verification and encryption credentials, in a relational database table named saml2_asserting_party_metadata. The credential collections are serialized as Java objects into the verification_credentials and encryption_credentials columns and rehydrated via Java's native deserialization when the repository loads metadata. CWE-502 (Deserialization of Untrusted Data) applies: any gadget chain present on the application classpath (Spring, Apache Commons, Hibernate, etc.) can be triggered when the malicious blob is read back, turning a database write primitive into in-process code execution under the Spring Security web application's JVM identity. The affected CPE is cpe:2.3:a:vmware:spring_security, and the SAML2 JDBC metadata repository was added in the 7.x branch.

RemediationAI

Upgrade to Spring Security 7.0.6 or later, which is the vendor-released patched version per the Spring advisory at https://spring.io/security/cve-2026-40993 and EUVD-2026-35886. If immediate upgrade is not feasible, tightly restrict who and what can issue INSERT/UPDATE statements against the saml2_asserting_party_metadata table by enforcing least-privilege database accounts so that only a dedicated metadata-management identity (not the application's runtime account, and not shared with other tenants) can write the verification_credentials and encryption_credentials columns; this prevents an attacker who compromises another component from poisoning the table at the cost of operational friction during metadata rotation. Audit existing rows in the table for unexpected serialized blobs before patching and, where feasible, switch to a non-JDBC AssertingPartyMetadataRepository implementation (e.g., the in-memory or file-based variants) until the upgrade lands, accepting that this loses the dynamic-update behavior the JDBC store provides.