Security readout for executives and security teams
Plain-English summary
Spring Boot’s ${random.value} can produce values that are too predictable for secrets. If an application used it to create passwords, tokens, or similar secret material, attackers may have a better chance of guessing them. Fixed Spring Boot releases are available for supported branches listed in the advisory.
Executive priority
Treat as high priority where Spring Boot applications generate or embed secrets from configuration. Prioritize internet-facing and authentication-sensitive services first, then complete branch upgrades and secret rotation during normal vulnerability remediation windows.
Technical view
CVE-2026-40975 affects Spring Boot random value property source behavior. ${random.value} uses weak randomness for secret use; ${random.uuid} is not affected. ${random.int} and ${random.long} should not be used for secrets because they are numeric and bounded. CVSS is 8.2 with high confidentiality impact.
Likely exposure
Exposure is likely limited to Spring Boot applications on affected versions that use ${random.value}, ${random.int}, or ${random.long} as secret material. Applications using these properties only for non-secret values have materially lower risk.
Exploitation context
The provided bundle shows KEV is false and does not cite active exploitation. The risk comes from predictable secret generation, not a confirmed public exploit chain. Real-world impact depends on whether generated values protect sensitive access.
Researcher notes
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. Practical exploitability requires a target secret derived from weak random properties. The source bundle does not provide exploit details or claim active exploitation.
Mitigation direction
- Upgrade to Spring Boot 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33 as applicable.
- Replace ${random.value} secrets with values from a cryptographically secure secret-generation process.
- Do not use ${random.int} or ${random.long} for secrets.
- Rotate any deployed secrets that may have been generated from affected properties.
- Review Red Hat advisories if consuming Spring Boot through Red Hat packages.
Validation and detection
- Inventory applications and dependencies for affected Spring Boot version ranges.
- Search configuration for ${random.value}, ${random.int}, and ${random.long} in secret-related settings.
- Confirm upgraded builds resolve to the fixed Spring Boot branch version.
- Review secret provenance and rotate values where origin cannot be trusted.
- Document whether ${random.uuid} usage is present; the advisory says it is not affected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-330: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-338: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-40975 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2redhat-SADPCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N2.22.5vmwareVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Base CVSS 3.1 score
4.8MediumVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-28T00:01:58.716Z: Reported to Red Hat.
- 2026-04-27T23:32:58.596Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://spring.io/security/cve-2026-40975CVE reference, vmware
- https://access.redhat.com/security/cve/CVE-2026-40975CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2463331CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40975.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:25089CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22619CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21772CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17668CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Insufficiently Random Values
Use of Insufficiently Random Values represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.