Is CVE-2026-40965 actively exploited?

No active exploitation of CVE-2026-40965 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40965 be exploited remotely?

Yes. CVE-2026-40965 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40965?

CVE-2026-40965 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-40965

CRITICAL

CVE-2026-40965

CWE-200Published: June 1, 2026· Updated: Jun 2, 2026

10.0

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.9th

Official Description

Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability affects deployments using EC keys for JWT token signing. The vulnerability does not affect RSA key configurations, only deployments using EC keys for JWT signing.

Affected versions:

- uaa_release: v76.12.0 through v78.12.0 (inclusive); fixed in v78.13.0 or later

- CF Deployment: v30.0.0 through v56.0.0 (inclusive); fixed in v56.1.0 or later (bundles uaa_release v78.13.0)

NVD Source

Risk Analysis

This critical vulnerability in Cloud Foundry UAA versions v76.12.0 through v78.12.0 exposes EC (Elliptic Curve) private keys through the public /token_keys endpoint. This allows an attacker to obtain sensitive cryptographic material, potentially compromising the integrity and confidentiality of JWT tokens. The CVSS score of 10.0 indicates the highest possible severity, making this an extremely urgent issue.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable without authentication and has low attack complexity.

Recommended Action

Upgrade Cloud Foundry UAA to v78.13.0 or later, or CF Deployment to v56.1.0 or later, to address this private key exposure. If using EC keys for JWT token signing, rotate all affected keys immediately after patching.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-40965 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.