EUVD-2026-36204

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40994 Source advisory: MEND:CVE-2026-40994...

io.camunda.connector:connector-runtime-bundle (>=8.5.17, <=8.5.22), io.camunda.connector:connector-soap (>=8.5.17, <=8.9.0-alpha2) +2 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.1.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.1.0, =8.5.17, =8.5.17, =8.5.17, =7.3.0-rc2, =7.3.8.3 Source cves: CVE-2026-40994 Source advisory: MEND:CVE-2026-40994...

CVE-2026-40994 Wss4jSecurityInterceptor disables WS-I BSP validation by default

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

CVE-2026-40994

Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...

CVE-2026-40996: Use of a Broken or Risky Cryptographic Algorithm

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators explicitly reconfigured the flag...

PT-2026-80296

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-1 5 encrypted key material unless operators explicitly reconfigured the flag...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40995 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320712...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40996 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320523...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40997 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320569...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40996 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320523...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40997 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320569...

Use of RSA Algorithm without OAEP

Overview Affected versions of this package are vulnerable to Use of RSA Algorithm without OAEP via the Wss4jSecurityInterceptor class, in the Wss4jSecurityInterceptor.java file due to defaulting allowRSA15KeyTransportAlgorithm to true when building the validation RequestData. This overrides Apach...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-41000 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320735...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40994 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320710...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40994 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40994 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320710...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-40995 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320712...

io.camunda.connector:connector-soap (>=8.9.0-alpha3, <=8.10.0-alpha2), org.apereo.cas:cas-server-support-inwebo-mfa (>=8.0.0-rc1, <=8.0.0-rc5) potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=5.0.0, <=5.0.1)

org.springframework.ws:spring-ws-security MAVEN version =5.0.0, =8.9.0-alpha3, =8.0.0-rc1, =8.0.0-rc5 Source cves: CVE-2026-41000 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320735...

CVE-2026-9319

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security...

CVE-2026-9319 IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security...