Spring Integration CVE-2026-47861

Exploitation requires that the target application has a Spring Integration UDP inbound channel adapter configured and that its listening port is reachable from the attacker over the network. This is a non-default, explicitly configured component - it must be intentionally included in the Spring Integration message flow configuration. Exploitation is limited by: (1) the application must use the UDP inbound adapter feature specifically, not merely Spring Integration in general; (2) the adapter's UDP port must be network-accessible to the attacker, which depends on firewall rules; and (3) per the official CVSS PR:L vector (conflicting with the 'unauthenticated' claim in the description), some form of authentication may be required - this is unresolved and should be verified against the vendor advisory. If the description is accurate and no authentication is needed, exploitation requires only a reachable UDP port and knowledge of the adapter's port number.

The official CVSS score of 6.3 (Medium) carries a notable discrepancy: the vector specifies PR:L (low privileges required), yet the description explicitly states 'unauthenticated remote attacker.' UDP is a connectionless, stateless protocol where no authentication handshake occurs, making PR:N the more accurate metric - this warrants verification with the vendor. If the description is accurate, the real-world exploitability is higher than the CVSS score implies. EPSS data is not available in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The impact triad (C:L/I:L/A:L) reflects the SSRF-class risk: internal network probing via the server, potential UDP amplification relay, and possible interference with UDP-based services. The primary limiting factor is deployment scope: Spring Integration UDP adapters are not a default or common configuration - they require deliberate developer setup, significantly reducing the attack surface in practice. This is a real vulnerability for applications with exposed UDP adapters, but not a broad mass-exploitation concern given its prerequisite.

An attacker discovers a Spring Integration application with a UDP inbound adapter port exposed (e.g., through network scanning or service enumeration). The attacker sends a single crafted UDP datagram to the adapter containing an attacker-controlled destination host and port embedded in the payload. The server processes the packet and emits an outbound UDP datagram to the specified target - for example, an internal database host or a UDP amplification service - effectively using the server as an unwitting relay to reach otherwise-inaccessible internal segments or to launch reflected amplification attacks. No public exploit code is known at time of analysis.