What is the CVSS score of CVE-2026-40987?

CVE-2026-40987 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Spring Integration are affected by CVE-2026-40987?

Spring Integration's FTP, SFTP, and SMB adapters in versions 5.5.0 through 7.0.4 contain a path traversal vulnerability allowing compromised or malicious remote file servers to write arbitrary files…. A patch is available.

How to fix or mitigate CVE-2026-40987?

Within 24 hours: Identify all systems running affected Spring Integration versions (5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, 7.0.0-7.0.4) and which use FTP/SFTP/SMB inbound adapters. Within 7 days: Restrict network access to remote file servers using firewall rules and network segmentation; implement file integrity monitoring on affected systems. Within 30 days: Disable FTP/SFTP/SMB adapters if not required; evaluate alternative file transfer mechanisms; monitor Spring project security advisories for patch releases.

Spring Integration CVE-2026-40987

EUVD-2026-36202 HIGH

Path Traversal (CWE-22)

2026-06-11 vmware

GHSA-792x-6vq6-j8r9

Path Traversal Java Spring Integration Red Hat

7.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

vuln.today AI

7.3 HIGH

Attacker must control the remote server the client is configured to trust (PR:H, AC:H, UI:R); arbitrary file write yields high integrity and availability impact with scope change beyond the app sandbox, no direct confidentiality loss.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:03 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework.integration:spring-integration-file (5 direct, 1 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Articles & Coverage 2

News 7 New Java Vulnerabilities - 7 High Severity, No Public POC Jun 12, 2026 News 7 New Java Vulnerabilities - 7 High Severity, No Public Exploits Jun 11, 2026

AnalysisAI

Path traversal in Spring Integration's FTP/SFTP/SMB inbound adapters allows a malicious or compromised remote file server to write attacker-controlled files outside the configured local directory on any client polling it, affecting versions 5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, and 7.0.0-7.0.4. The flaw inverts the usual trust model - the file-transfer client trusts the server's filename, enabling overwrite of arbitrary host files such as configuration, cron, or application JARs, which can escalate to code execution. No public exploit identified at time of analysis, but the issue is straightforward to weaponize once a hostile server endpoint is reachable.

Technical ContextAI

Spring Integration is the VMware/Spring messaging-integration framework (CPE cpe:2.3:a:spring:spring_integration) that provides inbound channel adapters for FTP, SFTP, and SMB to synchronize remote directories into a local staging directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the inbound synchronizer uses the remote filename verbatim when constructing the local destination path, so a server returning a name containing '../' segments or an absolute path escapes the configured local-directory sandbox. Because Java's java.io.File and Files.copy honor traversal sequences and absolute paths, the framework writes the file wherever the attacker directs, with the JVM's filesystem permissions.

RemediationAI

Patch available per vendor advisory at https://spring.io/security/cve-2026-40987; upgrade to the fixed maintenance release in your branch (5.5.x, 6.3.x, 6.4.x, 6.5.x, or 7.0.x past the affected ceiling listed above) as the primary fix, since the framework must reject traversal sequences and absolute paths in remote filenames. If you cannot upgrade immediately, restrict inbound FTP/SFTP/SMB adapters to file servers under your direct administrative control and pin them by hostname plus host-key/credentials, and add a custom FileListFilter or filename sanitizer that rejects any remote name containing '..', a leading '/', a drive letter, or NUL bytes - note this is a defense-in-depth measure that you must audit yourself, since malformed filters silently allow traversal. As a containment measure, run the JVM under a dedicated unprivileged user with write access only to the configured local-directory (e.g., via SELinux/AppArmor or filesystem ACLs), which limits the blast radius if the bypass succeeds but does not prevent overwrite of files the JVM legitimately owns, such as application JARs and config.