What is the CVSS score of CVE-2026-47858?

CVE-2026-47858 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Spring Tools are affected by CVE-2026-47858?

Spring Tools IDE extensions pose remote code execution risk to developer workstations through their live monitoring feature, potentially compromising source code, development credentials, and…

How to fix or mitigate CVE-2026-47858?

Within 24 hours, audit all developer workstations for Spring Tools IDE versions 5.2.0 (Eclipse) and 2.2.0 (VSCode/Cursor/Theia) and disable the live information monitoring feature to eliminate active exploitation vector. Within 7 days, implement firewall rules to restrict JMX endpoint access (typically ports 9010-9011) on development systems to authorized administrative networks only, and establish ongoing monitoring of Spring Tools security advisories for patch announcements. Within 30 days, evaluate vendor security releases for patched versions, establish a patching timeline, and complete upgrades to patched releases once available; conduct comprehensive review of JMX security posture across development infrastructure.

Spring Tools CVE-2026-47858

EUVD-2026-50970 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-30 vmware

GHSA-qhpg-2hp9-2j5r

Authentication Bypass RCE Java Spring Spring Tools For Eclipse Spring Tools For Vscode Cursor Theia

8.0

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Adjacent-network JMX exposure (AV:A), no attacker privileges (PR:N), but the developer must enable live mode and launch the app (UI:R); full RCE yields C/I/A High.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 05:50 vuln.today

CVE Published

Jul 30, 2026 - 05:15 cve.org

HIGH 8.0

DescriptionCVE.org

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Articles & Coverage 1

News 3 New Java Vulnerabilities - 3 High Severity Jul 31, 2026

AnalysisAI

Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Spring Tools provides IDE integrations (Eclipse, VSCode, Cursor, Theia) for Spring Boot development; its 'live information' feature connects the IDE to a running application to display real-time bean, mapping, and metrics data, and it does this over JMX (Java Management Extensions). When live mode is enabled, the Spring Boot process is started with a JMX server that, in the vulnerable configuration, is reachable without adequate authentication. JMX-based RCE typically stems from the ability to invoke or register MBeans (e.g., loading a remote MLet or abusing management operations), a root-cause class aligned with unsafe management-interface exposure and Java deserialization (CWE-502 / CWE-749); the official CVE assigns no CWE, so this classification is inferred rather than vendor-confirmed.

RemediationAI

Patch available per vendor advisory (https://spring.io/security/cve-2026-47858): upgrade Spring Tools for Eclipse beyond 5.2.0 and Spring Tools for VSCode/Cursor/Theia beyond 2.2.0 to the fixed releases - the exact fixed version numbers are not stated in the provided data and should be confirmed against the spring.io advisory before deployment. As an interim workaround, disable the 'live information' mode in the Spring Tools extension so applications are not launched with the exposed JMX server (trade-off: developers lose real-time bean/mapping/metrics introspection in the IDE). Additionally, developers should avoid running live-mode-enabled Spring Boot apps on untrusted or shared networks and can restrict JMX exposure by binding it to localhost or firewalling the JMX/RMI ports so adjacent hosts cannot reach them (trade-off: may block legitimate remote monitoring tooling).