{"metadata": {"vulnerability": "cve-2026-40982", "count": 35, "kinds": {"milestone": 7, "sighting": 10, "kev": 0, "other": 18}}, "data": [{"timestamp": "2026-04-16T02:19:04.616Z", "date_only": false, "value": "2026-04-16T02:19:04.616Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-40982", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-06T00:00:00Z", "date_only": true, "value": "2026-05-06", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0543", "record": "CERTFR-2026-AVI-0543", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "vulnerabilities.3.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-05-07T00:00:00Z", "date_only": false, "value": "2026-05-07T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0543", "record": "CERTFR-2026-AVI-0543", "field": "last_revision_date"}, {"timestamp": "2026-05-07T00:00:00Z", "date_only": false, "value": "2026-05-07T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0543", "record": "CERTFR-2026-AVI-0543", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-07T00:00:00Z", "date_only": false, "value": "2026-05-07T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0543", "record": "CERTFR-2026-AVI-0543", "field": "revisions.0.revision_date"}, {"timestamp": "2026-05-07T03:49:30.065Z", "date_only": false, "value": "2026-05-07T03:49:30.065Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat-SADP", "record": "cve-2026-40982", "field": "containers.adp.1.datePublic"}, {"timestamp": "2026-05-07T03:49:30.065Z", "date_only": false, "value": "2026-05-07T03:49:30.065Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-40982", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-07T03:49:30.065Z", "date_only": false, "value": "2026-05-07T03:49:30.065Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat-SADP", "record": "cve-2026-40982", "field": "containers.adp.1.timeline.1.time"}, {"timestamp": "2026-05-07T03:49:30.065Z", "date_only": false, "value": "2026-05-07T03:49:30.065Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / vmware", "record": "cve-2026-40982", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-07T04:16:24Z", "date_only": false, "value": "2026-05-07T04:16:24Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6G23-24MC-HX6X", "record": "GHSA-6G23-24MC-HX6X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-05-07T04:16:24.790Z", "date_only": false, "value": "2026-05-07T04:16:24.790", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-40982", "record": "FKIE_CVE-2026-40982", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-07T04:30:27.681Z", "date_only": false, "value": "2026-05-07T04:30:27.681922Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116531411462780607", "record": "cve-2026-40982", "field": "creation_timestamp", "uuid": "957d540f-dbcb-4347-9a14-7eb43d517a2e", "content": "\u26a0\ufe0f CRITICAL: CVE-2026-40982 in Spring Cloud Config (3.1.0 \u2013 5.0.0) enables path traversal \u2014 attackers can access arbitrary files via crafted URLs. Upgrade to a safe version ASAP: 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3. Details: https://radar.offseq.com/threat/cve-2026-40982-cwe-22-improper-limitation-of-a-pat-df996457 #OffSeq #SpringCloud #CVE202640982", "url": "https://infosec.exchange/users/offseq/statuses/116531411462780607"}, {"timestamp": "2026-05-07T04:30:29.452Z", "date_only": false, "value": "2026-05-07T04:30:29.452864Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mlaeyqh2um2y", "record": "cve-2026-40982", "field": "creation_timestamp", "uuid": "a33aac8e-e2dc-46cb-827d-c85f823555ea", "content": "Spring Cloud Config (3.1.0 \u2013 5.0.0) hit by CRITICAL path traversal flaw \u2014 attackers may access files via crafted URLs. Upgrade to 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 now! https://radar.offseq.com/threat/cve-2026-40982-cwe-22-improper-limitation-of-a-pat-df996457 #OffSeq #SpringCloud #CVE202640982", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mlaeyqh2um2y"}, {"timestamp": "2026-05-07T05:01:22.608Z", "date_only": false, "value": "2026-05-07T05:01:22.608Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat-SADP", "record": "cve-2026-40982", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2026-05-07T05:25:46.120Z", "date_only": false, "value": "2026-05-07T05:25:46.120237Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlai3lq23y2p", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "e1b1f2a3-eed9-4929-957f-a657f69d3c15", "content": "CVE-2026-40982 - Spring Cloud Config Directory Traversal Vulnerability\nCVE ID : CVE-2026-40982\n \n Published : May 7, 2026, 3:49 a.m. | 35\u00a0minutes ago\n \n Description : Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-conf...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlai3lq23y2p"}, {"timestamp": "2026-05-07T06:31:41Z", "date_only": false, "value": "2026-05-07T06:31:41Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6G23-24MC-HX6X", "record": "GHSA-6G23-24MC-HX6X", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-07T06:48:23Z", "date_only": false, "value": "2026-05-07T06:48:23.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-431", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "ee676326-2996-41b8-a279-166e4ff579b1", "url": "https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-431"}, {"timestamp": "2026-05-07T07:29:50Z", "date_only": false, "value": "2026-05-07T07:29:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-spring-cloud-config", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "c1398d9b-3d96-40b2-ba85-0e5333228e86", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-spring-cloud-config"}, {"timestamp": "2026-05-07T11:05:54.874Z", "date_only": false, "value": "2026-05-07T11:05:54.874+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.generator.date"}, {"timestamp": "2026-05-07T14:40:20.407Z", "date_only": false, "value": "2026-05-07T14:40:20.407806Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbh3arwaw2e", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "bc9e001b-f6fc-4269-9611-e0cf8ec4fb8f", "content": "\ud83d\udd17 CVE : CVE-2026-40981, CVE-2026-40982, CVE-2026-41002, CVE-2026-41004", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbh3arwaw2e"}, {"timestamp": "2026-05-09T03:55:58.317Z", "date_only": false, "value": "2026-05-09T03:55:58.317317Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-40982", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-09T03:55:58.317Z", "date_only": false, "value": "2026-05-09T03:55:58.317317Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-40982", "record": "FKIE_CVE-2026-40982", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-10T14:30:47.242Z", "date_only": false, "value": "2026-05-10T14:30:47.242Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-40982", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-19T20:00:03.828Z", "date_only": false, "value": "2026-05-19T20:00:03.828085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mma6jybelc2w", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "b8a0d20d-3019-459f-b637-ed169f6da997", "content": "\u300cSpring Cloud Config\u300d\u306b\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306a\u3069\u8907\u6570\u8106\u5f31\u6027\n\n\u5206\u6563\u30b7\u30b9\u30c6\u30e0\u3084\u30de\u30a4\u30af\u30ed\u30b5\u30fc\u30d3\u30b9\u74b0\u5883\u306e\u8a2d\u5b9a\u7ba1\u7406\u30c4\u30fc\u30eb\u300cSpring Cloud Config\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3002\n\n\u958b\u767a\u30c1\u30fc\u30e0\u306f\u73fe\u5730\u6642\u95932026\u5e745\u67086\u65e5\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3057\u30014\u4ef6\u306e\u8106\u5f31\u6027\u3092\u660e\u3089\u304b\u306b\u3057\u305f\u3002\n\n\u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u901a\u3058\u3066\u30c6\u30ad\u30b9\u30c8\u30d5\u30a1\u30a4\u30eb\u3084\u30d0\u30a4\u30ca\u30ea\u30d5\u30a1\u30a4\u30eb\u3092\u914d\u4fe1\u3059\u308b\u69cb\u6210\u306e\u5834\u5408\u3001\u7d30\u5de5\u3057\u305fURL\u306b\u3088\u3063\u3066\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u8a8d\u8a3c\u3092\u5fc5\u8981\u3068\u3059\u308b\u3053\u3068\u306a\u304f\u30d5\u30a1\u30a4\u30eb\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u3068\u306a\u308b\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u306e\u8106\u5f31\u6027\u300cCVE-2026-40982\u300d\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3002\n\n\u5171\u901a\u8106\u5f31\u6027\u8a55\u4fa1\u30b7\u30b9\u30c6\u30e0\u300cCVSSv3.1\u300d\u306e\u30d9\u30fc...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mma6jybelc2w"}, {"timestamp": "2026-06-11T14:50:14Z", "date_only": false, "value": "2026-06-11T14:50:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6G23-24MC-HX6X", "record": "GHSA-6G23-24MC-HX6X", "field": "modified"}, {"timestamp": "2026-07-15T01:00:13.424Z", "date_only": false, "value": "2026-07-15T01:00:13.424Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-40982", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-15T01:00:13.424Z", "date_only": false, "value": "2026-07-15T01:00:13.424Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat-SADP", "record": "cve-2026-40982", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-07T10:17:15.309Z", "date_only": false, "value": "2026-08-07T10:17:15.309296Z", "kind": "sighting", "label": "Seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "ec1b0f12-fda9-4f62-8af8-d35d1ef05a5b"}, {"timestamp": "2026-09-12T10:00:14.141Z", "date_only": false, "value": "2026-09-12T10:00:14.141032Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/shimiscyberworld/1256", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "ca0f7a1b-2139-4240-85a3-04055f75457f", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-40982 \u2014 CVSS 9.1\nSpring Cloud Config Vulnerability CVE-2026-40982 Allows Directory Traversal\n\nCVE-2026-40982 \u2014 Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can \n\n\ud83d\udd34 Critical \u00b7 2 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-40982 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "url": "https://t.me/shimiscyberworld/1256"}, {"timestamp": "2026-10-01T11:00:06.165Z", "date_only": false, "value": "2026-10-01T11:00:06.165442Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwspcro6fs2e", "record": "CVE-2026-40982", "field": "creation_timestamp", "uuid": "421ada87-8030-4ae3-82d7-946a762b7df6", "content": "CVE-2026-40982 - org.springframework.cloud:spring-cloud-config-server\nThe Spring Cloud Config Server libraries from Spring Framework, VMware, and Root are affected by a security weakness that could let\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#springframework #Java #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwspcro6fs2e"}, {"timestamp": "2026-10-26T19:10:00.163Z", "date_only": false, "value": "2026-10-26T19:10:00.163", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-40982", "record": "FKIE_CVE-2026-40982", "field": "lastModified"}], "metrics": {"as_of": "2026-10-28T12:48:10.966Z", "anchors": {"origin": {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 15086890.966486, "hours": 4190.803046246111, "days": 174.61679359358797, "min_seconds": 15086890.966486, "max_seconds": 15086890.966486, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-06T22:00:00Z", "date_only": false, "value": "2026-05-06T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1399", "record": "WID-SEC-W-2026-1399", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T12:48:10.966Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}