« Volver al listado

CVE-2026-40972

Estado: AnalizadaAlta (7.5)—

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A (red adyacente) + timing attack contra secret de DevTools → T1210. Acceso de código remoto tras descubrir el secret → T1059. Extracción de información sensible mediante timing → T1552.007 (credenciales/secretos).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramVulnerability ScanningUser Account ManagementThreat Intelligence Program

Tecnologías afectadas (1)

Vmware — Spring Boot

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-40972",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40972",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-28T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "modules": [
            "spring-boot-devtools"
          ],
          "product": "Spring Boot",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.5.0",
              "lessThan": "3.5.14",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.4.0",
              "lessThan": "3.4.16",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.3.0",
              "lessThan": "3.3.19",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.7.0",
              "lessThan": "2.7.33",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-28T00:16:24.210",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-40972",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@vmware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory."
    },
    {
      "lang": "es",
      "value": "Un atacante en la misma red que la aplicación remota podría ser capaz de utilizar un ataque de temporización para descubrir información sobre el secreto remoto. En circunstancias extremas, esto podría resultar en que el atacante determine el secreto y cargue clases modificadas, logrando así la ejecución remota de código en la aplicación remota.\n\nAfectado: Spring Boot 4.0.0-4.0.5 (corrección 4.0.6), 3.5.0-3.5.13 (corrección 3.5.14), 3.4.0-3.4.15 (corrección 3.4.16), 3.3.0-3.3.18 (corrección 3.3.19), 2.7.0-2.7.32 (corrección 2.7.33); comparación de secreto remoto de DevTools. Las versiones que ya no son compatibles también se ven afectadas según el aviso del proveedor."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B1C9BD7-7555-4B3D-AED9-60C3C13DCF46",
              "versionEndExcluding": "2.7.33"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28EE6470-24FD-49D1-A2F0-7A19B290A161",
              "versionEndExcluding": "3.3.19",
              "versionStartIncluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "758A9E8F-0C52-43D9-8D84-69622B345A4E",
              "versionEndExcluding": "3.4.16",
              "versionStartIncluding": "3.4.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D23096A1-8269-46C5-9215-9098E87D0A24",
              "versionEndExcluding": "3.5.14",
              "versionStartIncluding": "3.5.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12A166C5-8B55-4BA3-AA8B-6024A257D441",
              "versionEndExcluding": "4.0.6",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}