CVE-2026-40997

SOAP security faults leak Spring Security account state

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Web Services Spring Web Services

CVE-2026-59355

Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Authorization Server Spring Authorization Server

CVE-2019-3773

Spring Web Services XML External Entity Injection (XXE)

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed

Vendors

Broadcom Oracle Redhat

Products

Spring Web Services Financial Services Analytical Applications Infrastructure Flexcube Private Banking and 1 more

CVE-2026-47875

JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Batch Spring Batch

CVE-2026-47863

Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Reactor Core Reactor Core

CVE-2026-47881

Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Batch Spring Batch

CVE-2020-5411

Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Broadcom

Products

Spring Batch

CVE-2019-3774

Spring Batch XML External Entity Injection (XXE)

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed

Vendors

Broadcom Redhat

Products

Spring Batch Jboss Fuse

CVE-2026-59284

Spring Cloud Commons no allow list for writable env actuator endpoint

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Cloud Commons Spring Cloud Commons

CVE-2026-59316

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Authorization Server Spring Authorization Server

CVE-2026-47865

VMware Avi Load Balancer Authentication Bypass Vulnerability

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2026-47866

VMware Avi Load Balancer Authorization Bypass Vulnerability

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2026-47867

VMware Avi Load Balancer Remote Code Execution Vulnerability

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2026-47868

VMware Avi Load Balancer Local Privilege Escalation Vulnerability

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2026-47869

VMware Avi Load Balancer Remote Code Execution Vulnerability

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2026-47870

VMware Avi Load Balancer Privilege Escalation Vulnerability

VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2026-47871

VMware Avi Load Balancer Directory Traversal Vulnerability

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Broadcom Vmware

Products

Vmware Avi Load Balancer Vmware Avi Load Balancer

CVE-2021-40438

mod_proxy SSRF

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVSS 3.1 · 9 Critical EPSS 100.0% KEV · Listed

Vendors

Apache Broadcom Debian and 8 more

Products

Http Server Brocade Fabric Operating System Firmware Debian Linux and 42 more

CVE-2026-15379

Arbitrary File Read as SYSTEM in Symantec ITMS

The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Symantec Server Management Suite

CVE-2026-15380

Local privilege escalation in Symantec ITMS

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3)

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom

Products

Symantec Server Management Suite