What is the CVSS score of CVE-2026-47838?

CVE-2026-47838 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Security are affected by CVE-2026-47838?

Spring Security versions 5.7 through 6.5 contain a flaw in certificate verification that allows attackers with a specially crafted certificate to gain unauthorized access as another legitimate user.. A patch is available.

How to fix or mitigate CVE-2026-47838?

Within 24 hours: Inventory all systems running Spring Security versions 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, or 6.5.0-6.5.10 with X.509 certificate authentication enabled. Within 7 days: Obtain Spring Security patch from vendor advisory, test in non-production environments, and prepare deployment plan. Within 30 days: Deploy patched Spring Security versions to all production systems and audit certificate authentication logs for suspicious access patterns.

Spring Security CVE-2026-47838

EUVD-2026-35911 HIGH

Improper Authentication (CWE-287)

2026-06-10 security@vmware.com

GHSA-293q-567p-wmwq

Authentication Bypass Java Spring Security

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (vmware) PRIMARY

MEDIUM

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable mTLS endpoint (AV:N, AC:L); attacker must hold a CA-signed client cert with controlled CN (PR:L); full impersonation yields C:H/I:H, no service disruption (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 03:48 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 03:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 03:38 vuln.today

cvss_changed

Severity Changed

Jun 18, 2026 - 03:38 NVD

MEDIUM HIGH

CVSS changed

Jun 18, 2026 - 03:38 NVD

6.8 (MEDIUM) 8.1 (HIGH)

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:46 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,100 maven packages depend on org.springframework.security:spring-security-web (439 direct, 661 indirect)

Ecosystem-wide dependent count for version 6.5.0.

DescriptionNVD

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

AnalysisAI

Authentication bypass via X.509 certificate impersonation in Spring Security affects versions 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, and 6.5.0-6.5.10, where the SubjectDnX509PrincipalExtractor mishandles malformed Common Name (CN) values and resolves the principal to the wrong identity. An attacker holding a carefully crafted client certificate can authenticate as a different legitimate user, gaining their privileges. No public exploit identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects no observed exploitation activity.

Technical ContextAI

Spring Security is the de-facto authentication and authorization framework for Java applications built on the Spring ecosystem, including Spring Boot REST APIs and MVC web apps. The vulnerable component, SubjectDnX509PrincipalExtractor, is the default extractor used when applications enable mutual TLS / X.509 client-certificate authentication; it parses the Subject Distinguished Name from a presented certificate and extracts a field (typically CN) as the username that is then mapped to a UserDetails record. The root cause maps to CWE-287 (Improper Authentication): the parsing logic does not correctly normalize or escape certain malformed CN values, so a CN containing crafted delimiters, embedded RDN-like sequences, or special characters is interpreted as a different principal string than the certificate's true subject. Per CPE, all affected releases are tracked under cpe:2.3:a:vmware:spring_security and the issue was disclosed by VMware/Broadcom (security@vmware.com).

RemediationAI

Vendor-released patches are available: upgrade to Spring Security 5.7.25, 5.8.27, 6.3.18, 6.4.18, or 6.5.11 per your maintenance branch, as listed in the EUVD record and the Spring advisory at https://spring.io/security/cve-2026-47838. If immediate patching is not possible, the most effective compensating control is to replace SubjectDnX509PrincipalExtractor with a SubjectX500PrincipalExtractor or a custom X509PrincipalExtractor that resolves the principal from a stable, non-CN attribute (for example the certificate serial number or a fingerprint) - this avoids the CN parsing path entirely but requires updating any downstream UserDetails lookup keyed on CN. Tightening the trusted CA list so only an internal CA (which strictly validates CN values at issuance) can sign client certificates also blocks the practical attack path, at the cost of breaking external-PKI federation. Audit recent successful X.509 logins for CN values containing unusual punctuation, escape sequences, or embedded RDN separators to identify possible exploitation attempts.