CVE-2026-41839

score

4.9

cvss

4.2

epss

0.2%

published

2026-06-09

kev added

—

first seen

2026-10-21

Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48 contain a session fixation vulnerability caused by compromised subdomain allowing session ID exchange, letting attackers escalate privileges by hijacking authenticated sessions, exploit requires compromised subdomain.