Search

VMware Tanzu Spring Security Critical Flaws, CVSS 9.6

CERT-Bund published a critical security advisory WID-SEC-2026-1221 for VMware Tanzu Spring Security, assigning a CVSS Base Score of 9.6 (critical) and a CVSS Temporal Score of 8.3 (high). Multiple vulnerabilities allow a remote attacker to disclose information, bypass security measures, impersonate users, or manipulate data, potentially enabling privilege escalation, SSRF, or Cross-Site-Scripting attacks. Affected versions are VMware Tanzu Spring Security <6.5.10, <7.0.5, and <7.1.0-RC1. Organizations running these versions should apply mitigations immediately.