EUVD-2026-50973
GHSA-cpfc-g4p9-rg24
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Deployed DevTools remote endpoint is typically network-reachable (AV:N); predicting the weak PRNG secret is non-trivial (AC:H); no privileges needed (PR:N); compromise crosses to the separate deployed app (S:C) enabling full code execution (C/I/A:H).
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Articles & Coverage 3
AnalysisAI
Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that Spring Boot DevTools remote support has been explicitly enabled for a remote application target (Docker container or Cloud Foundry app) via the Spring Tools Boot Dashboard, causing the vulnerable Spring Tools (≤5.2.0) to generate the shared secret with a non-cryptographic PRNG; the attacker must also be able to reach the deployed application's DevTools remote-restart endpoint over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (8.3 High) reflects an unauthenticated but non-trivial attack (AC:H for predicting the weak secret) whose successful exploitation crosses a security boundary (S:C) to fully compromise the deployed application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer enables DevTools remote support from the Spring Tools Boot Dashboard against a Cloud Foundry app, and Spring Tools generates a predictable shared secret. An attacker who can reach the app's DevTools remote endpoint predicts or brute-forces the weakly-random secret, authenticates a restart upload, and pushes malicious classes that execute as the application, achieving code execution. … |
| Remediation | Consult the vendor advisory at https://spring.io/security/cve-2026-47882 and upgrade Spring Tools for Eclipse to a release later than 5.2.0 once available; no exact fix version is provided in the available data, so treat this as 'patch available per vendor advisory' and confirm the fixed build number directly from spring.io. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit deployment pipelines and inventory all instances of Spring Tools for Eclipse 5.2.0 or earlier connected to production, staging, or cloud-deployed Spring Boot applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today