Spring Integration CVE-2026-47864

Exploitation requires the target application to have registered SerializingHttpMessageConverter as a message converter on an inbound HTTP endpoint AND to have at least one usable Java deserialization gadget class on its classpath; the attacker must send a request whose Content-Type is application/x-java-serialized-object and whose body resolves to a Serializable type. No authentication or user interaction is needed (PR:N/UI:N), and the attack is over the network (AV:N). The limiting factors are that this converter is not enabled by default for typical Spring apps, so deployments that do not use it or that expose only JSON/other converters are not exploitable, and even where the converter is present, RCE additionally depends on a present gadget chain - which is why CISA SSVC rates the attack as not automatable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) reflects an unauthenticated network attack of low complexity yielding full confidentiality, integrity, and availability impact - an accurate rating for a deserialization RCE when the vulnerable converter is actually wired to an inbound endpoint. However, that last condition is a meaningful gate: SerializingHttpMessageConverter is not a default-on component for arbitrary Spring apps, and exploitation additionally depends on a usable gadget being on the classpath, which is why CISA's SSVC framework records Exploitation: none, Automatable: no, Technical Impact: partial rather than total. EPSS of 3.44% (88th percentile) signals elevated but not extreme near-term exploitation likelihood, and there is no KEV listing and no confirmed public PoC, so this is a real, prioritize-soon issue rather than an actively-exploited emergency; teams running internet-facing Spring Integration HTTP endpoints - from large enterprises down to a mid-sized municipal IT operator - should treat it as urgent, while those not using this converter face substantially lower real-world exposure. The SSVC 'partial' technical impact somewhat contrasts with the CVSS 'all-High' impacts, so defenders should confirm whether their own deployment actually exposes the converter before deciding how hard to push emergency patching.

An attacker identifies a public HTTP endpoint whose application binds SerializingHttpMessageConverter, then POSTs a body with Content-Type application/x-java-serialized-object containing a serialized gadget chain (e.g. built with ysoserial). When the converter calls readObject(), the gadget executes during deserialization and runs the attacker's command as the application's service account. No credentials or user interaction are required, though success depends on a compatible gadget being present on the target's classpath.