Brief Summary: CVE-2026-40994 Spring Web Services BSP Enforcement Bypass via Insecure Default Initialization

Introduction

A silently disabled security control in one of the most widely deployed Java frameworks just exposed enterprise SOAP services to message integrity bypass. Spring Web Services' Wss4jSecurityInterceptor initialized its WS-I Basic Security Profile (BSP) compliance flag in a way that turned off BSP enforcement for inbound messages. That contradicts the secure default built into the underlying Apache WSS4J library and leaves services willing to accept non-compliant WS-Security messages over the network.

Spring powers applications at more than half of the Fortune 500, and SOAP-based web services remain a backbone of financial services, healthcare, and government integrations. That gives this insecure default, scored CVSS 8.2, a significant blast radius. The vulnerability was disclosed on June 10, 2026, as part of what Broadcom described as the largest Spring security update in the framework's 23-year history.

Technical Information

Root Cause: Insecure Default Initialization (CWE-1188)

The vulnerability is in the Wss4jSecurityInterceptor class in Spring Web Services. This component enforces WS-Security standards on SOAP messages and delegates the cryptographic processing to Apache WSS4J. During initialization, the interceptor configures a RequestData object that controls how WSS4J validates inbound messages.

The flaw itself is simple. Wss4jSecurityInterceptor initialized its BSP compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. That directly contradicts the secure default Apache WSS4J sets. In WSS4J 1.6.x and later, the wsiBSPCompliant flag in WSSConfig defaults to true, so BSP checks stay active unless someone explicitly turns them off. The Spring WS interceptor's initialization logic overrode that default, which stripped BSP validation from any application that used the interceptor without explicitly calling setBspCompliant(true).

The weakness falls under CWE-1188 ("Initialization of a Resource with an Insecure Default"), which describes cases where "the product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure." The CWE documentation notes that "developers often choose default values that leave the product as open and easy to use as possible out of the box," which is what happened here.

What BSP Enforcement Does

The WS-I Basic Security Profile (BSP) 1.1 specification is an industry standard for interoperability between different WS-Security stacks. It clarifies and narrows the scope of the various WS-Security standards. With BSP enforcement active, WSS4J checks that inbound messages follow strict rules on:

• Security element ordering
• Algorithm strength requirements
• Signature and timestamp profiles
• Token profile conformance

With BSP enforcement disabled, WSS4J skips these conformance checks entirely, and messages that violate BSP rules pass validation as if the rules did not exist.

Attack Flow

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N describes the exploitation profile:

An attacker exploits this vulnerability in two steps:

1. Identify a target service that uses Wss4jSecurityInterceptor for inbound WS-Security validation. These are SOAP endpoints, commonly found in enterprise and government environments.
2. Craft SOAP messages that violate BSP rules. Because BSP enforcement is silently disabled by default, the service will accept these non-compliant messages.

Two preconditions must hold:

• The application uses Wss4jSecurityInterceptor or equivalent wiring for inbound WS-Security validation.
• BSP compliance has not been explicitly enabled with the setBspCompliant setter.

The interceptor applies the insecure default automatically, so most deployments that use it would be vulnerable without any misconfiguration by the operator. The application appears to work normally. There is no error, no warning, and no sign that an entire class of validation has been silently disabled.

Distinction from Other CVEs in the Same Release

CVE-2026-40994 differs from the other six CVEs patched in the same release. CVE-2026-40995 (disabled account bypass), CVE-2026-40996 (weak RSA algorithm), CVE-2026-40998 (XXE), and CVE-2026-40999 (SSRF) are distinct implementation flaws. CVE-2026-40994 is a configuration default flaw. It needs no logic error in how a specific message construct is processed, and instead silently disables an entire class of validation. That makes it harder to detect, because the application appears to work normally, and broader in impact, because every BSP-defined check is skipped.

The June 10, 2026 release addressed these CVEs:

Affected Systems and Versions

Four major version branches of Spring Web Services are affected:

Any application that uses Wss4jSecurityInterceptor for inbound WS-Security validation is vulnerable unless BSP compliance has been explicitly enabled with the setBspCompliant(true) setter. The 4.0.x and 3.1.x branches no longer have active open-source support and have no public patches. Fixes for these branches are available only through VMware's Enterprise Support offering.

Spring Framework 6.2 and Spring Boot 3.5 reach end of life on June 30, 2026, just weeks after this disclosure. Organizations on those versions face compounding pressure to upgrade both their Spring versions and their support contracts to keep security coverage.

Vendor Security History

The Spring ecosystem has had a steady run of security advisories in 2026:

• CVE-2026-41842 and CVE-2026-41849: Spring Framework Denial of Service vulnerabilities
• CVE-2026-22732: Spring Security HTTP caching issues under certain conditions
• CVE-2026-40976: Spring Boot default web security bypass

Insecure default configurations have been a recurring theme in Spring security advisories. CVE-2026-40994 is another case of a framework component shipping with a default that weakened security instead of enforcing it.

Broadcom's coordinated June 2026 release fixed seven security vulnerabilities in Spring Web Services at once, and was described as the largest Spring security update in the framework's 23-year history. The size of the release was reportedly driven by a 1,700% monthly increase in AI-discovered advisories affecting the Java and Spring ecosystem.

VulnCheck's analysis of routinely targeted vulnerabilities in 2026 documented cases where Spring-adjacent vulnerabilities that were not exploited at time of disclosure were later used in the wild. That is a reason to patch promptly even when no exploitation has been confirmed.

References

• Spring Security Advisory: CVE-2026-40994
• NVD Entry: CVE-2026-40994
• Spring Web Services 5.0.2 and 4.1.4 Release Announcement
• CWE-1188: Initialization of a Resource with an Insecure Default
• Apache WSS4J User Guide
• WS-I Basic Security Profile Version 1.0
• WSSConfig API Documentation (Apache WSS4J 1.6.12)
• WSS4J 1.6 Basic Security Profile 1.1 Compliance
• Wss4jSecurityInterceptor API Documentation
• Broadcom Bolsters Spring Security with Largest Update Ever
• Spring Security Advisories
• Spring Web Services Project Page
• VulnCheck: Quantifying 2026 Routinely Targeted Vulnerabilities
• CISA KEV Catalog Update (June 8, 2026)