What is the CVSS score of CVE-2026-47882?

CVE-2026-47882 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Spring Tools are affected by CVE-2026-47882?

Spring Tools for Eclipse versions 5.2.0 and earlier use weak authentication to protect Spring Boot DevTools remote-restart uploads to production and container environments, allowing attackers who can…

How to fix or mitigate CVE-2026-47882?

Within 24 hours, audit deployment pipelines and inventory all instances of Spring Tools for Eclipse 5.2.0 or earlier connected to production, staging, or cloud-deployed Spring Boot applications. Within 7 days, disable Spring Boot DevTools remote-restart functionality in all non-development environments, or implement firewall rules restricting DevTools endpoint access to known administrative networks only. Within 30 days, upgrade to a patched Spring Tools for Eclipse version when released by VMware, or establish permanent network segmentation preventing untrusted networks from reaching DevTools ports.

Spring Tools CVE-2026-47882

EUVD-2026-50973 HIGH

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2026-07-30 vmware

GHSA-cpfc-g4p9-rg24

Java Information Disclosure Docker Spring Spring Tools For Eclipse

8.3

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Deployed DevTools remote endpoint is typically network-reachable (AV:N); predicting the weak PRNG secret is non-trivial (AC:H); no privileges needed (PR:N); compromise crosses to the separate deployed app (S:C) enabling full code execution (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:30 vuln.today

CVE Published

Jul 30, 2026 - 05:26 cve.org

HIGH 8.3

DescriptionCVE.org

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Articles & Coverage 3

News 3 New Docker Vulnerabilities - 1 Critical, 2 High Severity Jul 31, 2026 News 3 New Java Vulnerabilities - 3 High Severity Jul 31, 2026 News 3 New Docker Vulnerabilities - 3 High Severity, 1 With POC Jul 30, 2026

AnalysisAI

Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Spring Tools IDE tooling (cpe:2.3:a:spring:spring_tools_for_eclipse) and specifically its Boot Dashboard integration with Spring Boot DevTools 'remote' support. Spring Boot DevTools includes a RemoteSpringApplication client and a server-side endpoint that lets a developer trigger live restarts and file uploads to an application running elsewhere; these uploads are authenticated by a shared secret configured on both ends. Spring Tools automates provisioning that secret when a remote target is enabled from the Boot Dashboard. The root cause (no CWE assigned in the input, but functionally CWE-338 Use of Cryptographically Weak PRNG / CWE-330 Use of Insufficiently Random Values) is that this secret was produced with a general-purpose pseudo-random generator (e.g. java.util.Random-style) whose output is statistically predictable and, given enough observed values or knowledge of seeding, can be reconstructed - collapsing the entropy that the upload-authentication mechanism depends on.

RemediationAI

Consult the vendor advisory at https://spring.io/security/cve-2026-47882 and upgrade Spring Tools for Eclipse to a release later than 5.2.0 once available; no exact fix version is provided in the available data, so treat this as 'patch available per vendor advisory' and confirm the fixed build number directly from spring.io. As compensating controls until patched: do not enable DevTools remote support from the Boot Dashboard against internet- or shared-network-reachable targets, and never enable spring-boot-devtools remote in production deployments (remove the devtools dependency and any spring.devtools.remote.secret usage from production artifacts). If remote restart is required during development, restrict network access to the DevTools remote endpoint to trusted developer hosts (firewall/security-group allowlist or VPN) so a predictable secret cannot be exploited remotely, and manually set a long, high-entropy spring.devtools.remote.secret rather than relying on the tool-generated value - the trade-off being additional manual key management. Rotate any secrets previously generated by an affected Spring Tools version.