Spring Batch CVE-2026-47878

Exploitation requires that an attacker can write attacker-controlled bytes into the execution_context column of the Spring Batch JDBC repository tables (typically BATCH_JOB_EXECUTION_CONTEXT or BATCH_STEP_EXECUTION_CONTEXT). This write access implies one of the following preconditions: direct database write privileges via compromised credentials, a separate injection vulnerability in the application that allows writes to the batch repository, or control over an application input that the system persists as execution context. Additionally, a suitable Java deserialization gadget chain must be present on the server's classpath. The absence of an ObjectInputFilter is the universal default across all affected versions - no special non-default configuration is required for the deserialization path to be vulnerable - but the database write precondition is a hard prerequisite. The SSVC 'Automatable: no' rating reflects this dependency. Exploitation is also limited to platforms and versions where DefaultExecutionContextSerializer is used with a JDBC job repository; applications using only in-memory job repositories are not affected.

The provided CVSS vector (AV:N/AC:L/PR:N/UI:N, score 7.3) scores the vulnerability as unauthenticated and low-complexity, but this likely overstates accessibility: an attacker must first write malicious serialized data to the Spring Batch JDBC job repository, which in practice requires database write privileges or a separate write-path vulnerability in the application. This internal tension is reflected in the SSVC assessment (Automatable: no, Technical Impact: partial), which paints a more measured picture than the raw CVSS. The EPSS score is low (0.25%, 16th percentile) and no active exploitation appears in CISA KEV, supporting a scheduled-maintenance posture for most organizations; even a mid-sized municipal IT team in bytom would reasonably defer this to a planned patching cycle rather than invoke emergency response procedures. Conversely, the C:L/I:L/A:L impact ratings in the provided CVSS likely understate the true ceiling: successful Java deserialization gadget-chain attacks have historically yielded full RCE, bounded only by gadget availability on the classpath rather than by the vulnerability itself. CVSS and SSVC signals conflict on both exploitability and impact - assess real risk by auditing classpath gadget exposure and database write-access controls.

An attacker who has obtained write access to the Spring Batch JDBC job repository-via compromised database credentials, SQL injection in another application endpoint, or a misconfigured admin interface-crafts a Base64-encoded Java serialized payload embedding a gadget chain (e.g., using ysoserial with a commons-collections or spring-core module present on the target classpath). When a Spring Batch job or step is subsequently resumed or restarted, DefaultExecutionContextSerializer calls ObjectInputStream.readObject() on the injected bytes, triggering the gadget chain and executing arbitrary OS commands on the batch server. No public proof-of-concept has been identified at time of analysis.