What is the CVSS score of CVE-2026-41000?

CVE-2026-41000 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41000?

Yes, a patch is available for CVE-2026-41000. Update the affected software to the latest version immediately.

Spring Web Services CVE-2026-41000

EUVD-2026-36210 LOW

Authentication Bypass by Capture-replay (CWE-294)

2026-06-11 vmware

GHSA-8qq9-r6cc-qjv9

Apache Java Information Disclosure Spring Web Services

3.7

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

Network-reachable service (AV:N), but prior token interception required (AC:H); no attacker credentials needed (PR:N); only integrity affected via replay of authorized requests.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:05 vuln.today

CVE Published

Jun 11, 2026 - 05:04 cve.org

LOW 3.7

DescriptionCVE.org

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

AnalysisAI

Replay attack protections in Spring Web Services are silently ineffective across multiple major branches due to Wss4jSecurityInterceptor failing to wire configured Apache WSS4J ReplayCache instances into the RequestData object at validation time. Operators who believe UsernameToken nonce replay, Timestamp replay, and SAML one-time-use checks are enforced are unknowingly running without those controls. A network-positioned attacker can intercept and replay valid WS-Security tokens - including credentials and SAML assertions - to re-execute previously-authorized SOAP operations, with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Spring Web Services is a contract-first SOAP framework for Java; its Wss4jSecurityInterceptor delegates WS-Security header processing to Apache WSS4J, which provides ReplayCache abstractions to track seen nonces, Timestamps, and SAML one-time-use conditions as defined in the WS-Security and WS-SecurityPolicy specifications. The defect (CWE-294: Authentication Bypass by Capture-Replay) manifests because the interceptor did not consistently pass those configured ReplayCache instances into the RequestData object WSS4J consults during inbound message validation - meaning the cache is configured but never queried, producing a silent no-op. Affected CPE: cpe:2.3:a:spring:spring_web_services:*:*:*:*:*:*:*:*, spanning the 3.1.x, 4.0.x, 4.1.x, and 5.0.x release trains.

RemediationAI

The primary fix is to upgrade Spring Web Services to a patched release; exact fixed versions are not independently confirmed from the available intelligence data and must be obtained directly from the vendor advisory at https://spring.io/security/cve-2026-41000, where VMware/Spring documents the corrected releases for each supported branch. Where immediate upgrade is not feasible, operators can implement a compensating control at the network or API gateway layer by deduplicating inbound SOAP requests using WS-Addressing MessageID or message digest, which approximates replay detection without relying on the broken WSS4J cache path - note this adds latency and requires gateway infrastructure. Reducing the validity windows of UsernameToken TTL and WS-Security Timestamp expiry elements to the minimum operationally acceptable value narrows the replay window but does not eliminate it. Operators should not assume any replay cache configuration is enforced on affected versions.