What is the CVSS score of EUVD-2026-38596?

EUVD-2026-38596 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Spring Statemachine are affected by EUVD-2026-38596?

Spring Statemachine versions 3.2.0-3.2.4 and 4.0.0-4.0.1 contain a critical remote code execution vulnerability allowing authenticated attackers to execute arbitrary code within your JVM.. A patch is available.

How to fix or mitigate EUVD-2026-38596?

Within 24 hours: Identify all production systems running Spring Statemachine 3.2.0-3.2.4 or 4.0.0-4.0.1; cross-reference with application authentication scope to assess attack surface. Within 7 days: Research available patched versions through Spring security advisories or vendor releases; prepare upgrade testing in non-production environment. Within 30 days: Execute upgrade to patched version across all affected production systems and document remediation completion.

Spring Statemachine EUVD-2026-38596

| CVE-2026-41862 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-23 security@vmware.com

GHSA-85qj-f5wg-rwp9

RCE Java Deserialization Redis

8.8

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable persistence backend (AV:N), low complexity once write access exists (AC:L), requires write privilege to the store (PR:L), no user interaction, full RCE impact on JVM.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 23, 2026 - 22:02 EUVD

Analysis Generated

Jun 23, 2026 - 21:30 vuln.today

CVE Published

Jun 23, 2026 - 21:16 cve.org

HIGH 8.8

DescriptionCVE.org

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM.

Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

Articles & Coverage 1

News 3 New Java Vulnerabilities - 3 High Severity Jun 24, 2026

AnalysisAI

Remote code execution in Spring Statemachine 3.2.0-3.2.4 and 4.0.0-4.0.1 allows authenticated attackers to execute arbitrary code inside the application JVM by injecting malicious serialized Java objects into the Kryo-based persistence backends (JPA, MongoDB, Redis, or ZooKeeper). The flaw stems from deserializing persisted state-machine contexts without enforcing a class allowlist, a classic CWE-502 pattern that has historically yielded reliable gadget-chain exploitation in Java applications. No public exploit identified at time of analysis, but the deserialization sink and Kryo gadget ecosystem make weaponization straightforward once an attacker can write to the persistence store.

Technical ContextAI

Spring Statemachine is a Spring Framework library used to build hierarchical and distributed state machines in Java applications, with optional persistence so a state-machine's runtime context can survive restarts or be shared across cluster nodes. The library supports four persistence backends - JPA (relational databases), MongoDB, Redis, and Apache ZooKeeper - each backed by the Kryo serialization framework to marshal the StateMachineContext object. CWE-502 (Deserialization of Untrusted Data) applies because Kryo deserializers are invoked on persisted blobs without registering an allowlist of permitted classes; when Kryo is configured in its default 'auto-instantiate any class' mode, an attacker who can write into the backing store can supply a payload that constructs gadget chains (similar to ysoserial chains for Java) leading to RCE in the JVM hosting the state machine.

RemediationAI

Patch status: patch available per vendor advisory at https://spring.io/security/cve-2026-41862 - consult the advisory for the exact fixed releases in the 3.2.x and 4.0.x lines and upgrade Spring Statemachine accordingly. As a compensating control until patching, configure a strict Kryo class allowlist (Kryo.setRegistrationRequired(true) plus explicit kryo.register(...) calls for every legitimate StateMachineContext type) so unknown classes fail to deserialize; this is the most surgical mitigation but requires enumerating every persisted type. Alternatively, switch the persistence layer to a non-Kryo serializer (e.g., a JSON-based StateMachineSerialisationService), accepting a migration cost for existing persisted contexts. As a deployment-level mitigation, restrict write access on the JPA/Mongo/Redis/ZooKeeper instance to only the application identity and audit for any unexpected writers, recognizing this does not protect against compromise of that identity.