VulnSocial

CVE-2026-41728Patch(vmware / spring_data_rest)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch vmware spring_data_rest systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

vmware CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • spring_data_rest

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
vmware
Products
spring_data_rest

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-10: 1Patch / Workaround · 2026-06-10: 1Technical Details · 2026-06-10: 106-10
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-41728 - Supply Chain Attack in Spring Data REST. JSON Patch bypass allows unauthorized write access. CVSS 7.5. Unpatched—update to fixed versions immediately. #CVE #Spring #infosec #developers #json #rest OUR PATCH FOR FREE: https://www.valtersit.com/cve/CVE-2026-41728/

    Post summary

    The post reports CVE-2026-41728, a JSON Patch bypass in Spring Data REST that allows unauthorized writes, provides CVSS 7.5, urges immediate patching, and offers a free patch download.

    0000041
    920 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvmwarespring_data_rest---

Explore more

Back to dashboardvmware CVEsspring_data_rest vulnerabilities