THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-40997 (MEDIUM 5.3) — Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavi

[NVD] CVE-2026-40997 (MEDIUM 5.3) — Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavi

lownvdPublished 2026-06-11

CVE-2026-40997 CVSS: 5.3 MEDIUM Published: 2026-06-11T07:16:27.663

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid

MITRE ATT&CK techniques

Web ServicesT1583.006
Web ServicesT1584.006
Valid AccountsT1078
Valid AccountsAML.T0012

Indicators of compromise

CVE-2026-40997cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-40997