Cyber Resilience

CVE-2026-41729

HighRCEUpdated

Published: 10 June 2026

Published
10 June 2026
Modified
22 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0039 31.2th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-41729 is a high-severity Expression Language Injection (CWE-917) vulnerability in Vmware Spring Data Rest. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into…

more

a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

CWE(s)
CWE-917

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SpEL injection in Spring Data REST directly enables remote exploitation of a public-facing web application via crafted JSON Patch requests.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

vmware
spring data rest
3.7.0 — 3.7.19 · 4.3.0 — 4.3.16 · 4.4.0 — 4.4.14

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References