Is CVE-2026-47838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47838 being exploited in the wild.

How severe is CVE-2026-47838?

Medium severity, with a CVSS score of 6.8, published 10 June 2026.

Which products and versions are affected?

Broadcom Spring Security Web 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, 6.5.0 through 6.5.10; org.springframework.security:spring-security-web (Maven) ECOSYSTEM:introduced=6.5.0,fixed=6.5.11; VMware Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

Is there a fix for CVE-2026-47838?

Yes. org.springframework.security:spring-security-web (Maven): upgrade to 6.5.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47838 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47838?

Check whether you run Broadcom Spring Security Web, org.springframework.security:spring-security-web (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47838: VMware Spring Security user impersonation in SubjectDnX509PrincipalExtractor

CVE-2026-47838 · Severity: medium · CVSS 6.8 · Published 2026-06-10

Spring Security is a framework used to secure Java-based web applications. A vulnerability in how it processes digital certificates (X.509) allows an attacker to provide a specially crafted certificate to impersonate another user. This could lead to unauthorized access to sensitive data or administrative functions by bypassing intended identity verification.

Technologies: org.springframework.security:spring-security-web (Maven), VMware Spring Security. Vendors: Broadcom, Maven, VMware.

Quick answers

Is CVE-2026-47838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47838 being exploited in the wild.
How severe is CVE-2026-47838?: Medium severity, with a CVSS score of 6.8, published 10 June 2026.
Which products and versions are affected?: Broadcom Spring Security Web 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, 6.5.0 through 6.5.10; org.springframework.security:spring-security-web (Maven) ECOSYSTEM:introduced=6.5.0,fixed=6.5.11; VMware Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
Is there a fix for CVE-2026-47838?: Yes. org.springframework.security:spring-security-web (Maven): upgrade to 6.5.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47838 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47838?: Check whether you run Broadcom Spring Security Web, org.springframework.security:spring-security-web (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.security:spring-security-web (Maven): upgrade to 6.5.11 or later

# set org.springframework.security:spring-security-web to 6.5.11 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Spring Security Web's SubjectDnX509PrincipalExtractor where malformed X.509 certificate Common Name (CN) values are incorrectly parsed. This improper authentication flaw (CWE-287) allows an attacker with the ability to present a crafted certificate to have their username misidentified as a different user, leading to impersonation. The attack requires network access and has high complexity as it involves crafting specific certificate values. The SubjectDnX509PrincipalExtractor component has been deprecated and replaced by SubjectX500PrincipalExtractor to resolve this issue. Users should update to patched versions (e.g., 6.5.11) and migrate to the new extractor.

Affected products

Spring Spring Security Web 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, 6.5.0 through 6.5.10

Identifiers

CVE-2026-47838
GHSA-293q-567p-wmwq

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.