EUVD-2026-66839
GHSA-mvcx-qg6f-j67g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-reachable via untrusted data source with AC:H for non-default configuration; stated RCE capability warrants C:H/I:H/A:H, overriding vendor's conservative impact scoring.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
AnalysisAI
Arbitrary code execution via Jackson deserialization affects Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 when applications use Jackson2ExecutionContextStringSerializer and read job execution contexts from an untrusted data source. The JobParameterDeserializer's failure to enforce Jackson's trusted-types allowlist exposes the application to well-known Jackson polymorphic deserialization gadget chains, which can yield full remote code execution on the batch server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be met simultaneously: (1) the Spring Batch application must be explicitly configured to use Jackson2ExecutionContextStringSerializer for execution context serialization - this is not the default serializer in all deployments; (2) the job repository's underlying data source must be untrusted or writable by the attacker, meaning the attacker can inject crafted data into the repository before it is read and deserialized by the application; (3) the application's Java classpath must include one or more classes that form a viable Jackson RCE gadget chain, a condition commonly satisfied by enterprise application dependency trees. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 5.6 (Medium, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects the AC:H constraint - exploitation requires non-default configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the vendor advisory at https://spring.io/security/cve-2026-47875 for the specific fixed release version - no patched version number was provided in the available input data and none should be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today