The vulnerability CVE-2026-40994 in Spring Web Services arises from the Wss4jSecurityInterceptor initializing its BSP compliance flag in a way that disables enforcement of WS-I Basic Security Profile rules during inbound message validation. This misconfiguration allows WS-Security validating services to accept messages that violate BSP rules, thereby weakening protocol-level security checks. The affected versions include Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. The CVSS 3.1 score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation level is provided in the available data.

The vulnerability allows attackers to bypass WS-I Basic Security Profile enforcement in Spring Web Services, potentially permitting malformed or non-compliant WS-Security messages to be accepted by services that rely on this validation. This weakens protocol-level security checks and could lead to integrity violations of the processed messages. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Spring's official advisories for updates. Until a fix is available, consider additional WS-Security validation controls or compensating controls to enforce BSP compliance externally if feasible.