[UPDATE] [medium] VMware Tanzu Spring Boot: Multiple vulnerabilities

mediumCVE-2026-40992 CVE-2026-41001

An attacker from an adjacent network can exploit multiple vulnerabilities in VMware Tanzu Spring Boot to bypass security measures, disclose and manipulate information, or potentially execute code.

CSIRTS triage

vendor: VMware product: Tanzu Spring Boot Authentication bypass Information disclosure Code injection

What: Multiple vulnerabilities in Tanzu Spring Boot allow security bypass, information disclosure, manipulation, and potential code execution.
Who is affected: Users of VMware Tanzu Spring Boot on adjacent networks are affected.
Urgency: Medium priority; local network access required for exploitation.
Action: Apply patches for CVE-2026-40992 and CVE-2026-41001.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Tanzu Spring Boot

Get an email when a new Tanzu Spring Boot advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-08-10
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1883

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-409920.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-410010.09% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-40992	coverage & exploitation status	NVD · CVE.org
CVE-2026-41001	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.