Changeflow GovPing Data Privacy & Cybersecurity Italy CSIRT Advisories: Spring Security Vulnera...
Priority review Notice Added Final

Italy CSIRT Advisories: Spring Security Vulnerabilities Fixed, 1 Critical

Favicon for www.csirt.gov.it Italy CSIRT Advisories
Published
Detected
Email

Summary

CSIRT-ITA published alert AL02/260424/CSIRT-ITA on April 24, 2026, disclosing 8 vulnerabilities in Spring, the open-source Java framework used in enterprise applications. Affected versions span Spring Boot 2.7.x through 4.0.x. Three CVEs are highlighted: CVE-2026-40976 (critical), CVE-2026-40972 (high), and CVE-2026-40973 (high). System impact rating is assessed as High (65.51). Mitigation requires updating vulnerable installations per the vendor security bulletins linked in the advisory.

Why this matters

Organizations running Spring Boot in enterprise Java environments should inventory their deployments against the affected version ranges and prioritize patching for the critical CVE-2026-40976. Given the system impact rating of 65.51 and the inclusion of authentication bypass and arbitrary code execution among the vulnerability types, unpatched internet-facing Spring applications represent a high-priority remediation target.

AI-drafted from the source document, validated against GovPing's analyst note standards . For the primary regulatory language, read the source document .
Published by CSIRT-ITA on acn.gov.it . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .

About this source

GovPing monitors Italy CSIRT Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 15 changes logged to date.

What changed

CSIRT-ITA published a security alert identifying 8 vulnerabilities in Spring Framework and Spring Boot, including 1 critical and 2 high-severity flaws (CVE-2026-40976, CVE-2026-40972, CVE-2026-40973). The vulnerabilities affect Spring Boot versions 2.7.0–2.7.32, 3.3.0–3.3.18, 3.4.0–3.4.15, 3.5.0–3.5.13, and 4.0.0–4.0.5, plus all unsupported end-of-life versions.

Organizations running affected Spring deployments should update to patched versions as specified in Spring.io security bulletins. The alert covers four vulnerability types: Arbitrary Code Execution, Authentication Bypass, Information Disclosure, and Privilege Escalation. The recommended mitigation is vendor-guided patching; no alternative workarounds are specified in the advisory.

What to do next

  1. Update vulnerable Spring products to patched versions per vendor security bulletins

Archived snapshot

Apr 25, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.


Risolte vulnerabilità in Spring

**
Alert**

AL02/260424/CSIRT-ITA

Condividi
- Facebook
- Twitter
- LinkedIn
- Whatsapp

Sintesi

Aggiornamenti di sicurezza risolvono 8 vulnerabilità, tra cui una con gravità “critica” e due “alta”, in Spring, noto framework open‑source per lo sviluppo di applicazioni Java, usato in ambito enterprise.

Tipologia

  • Arbitrary Code Execution
  • Authentication Bypass
  • Information Disclosure
  • Privilege Escalation

Prodotti e/o versioni affette

Spring Boot

  • 4.0.x: versioni dalla 4.0.0 alla 4.0.5
  • 3.5.x: versioni dalla 3.5.0 alla 3.5.13
  • 3.4.x: versioni dalla 3.4.0 alla 3.4.15
  • 3.3.x: versioni dalla 3.3.0 alla 3.3.18
  • 2.7.x: versioni dalla 2.7.0 alla 2.7.32
  • tutte le versioni precedenti non più supportate (EOL).

Azioni di mitigazione

In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”:

CVE (3)

Cerca:
| CVE | POC | EXPLOITATION |
| --- | --- | --- |
| CVE-2026-40976 | - | - |
| CVE-2026-40972 | - | - |
| CVE-2026-40973 | - | - |

Riferimenti (4)

  1. https://spring.io/security/cve-2026-40976
  2. https://spring.io/security/cve-2026-40972
  3. https://spring.io/security/cve-2026-40973
  4. https://spring.io/security

Change log

Versione Note Data
1.0 Pubblicato il 24-04-2026 24/04/2026

Impatto sistemico

Alto (65.51)

Argomenti

Data pubblicazione

24/04/26 ore 11:38

Data Ultimo Aggiornamento

24/04/26 ore 11:38

Get daily alerts for Italy CSIRT Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CSIRT-ITA.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Classification

Agency
CSIRT-ITA
Published
April 24th, 2026
Instrument
Notice
Branch
Executive
Source language
it
Legal weight
Non-binding
Stage
Final
Change scope
Substantive

Who this affects

Applies to
Technology companies Government agencies Financial advisers
Industry sector
5112 Software & Technology
Activity scope
Vulnerability disclosure Security patching
Geographic scope
IT IT

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology

Get alerts for this source

We'll email you when Italy CSIRT Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!