Spring Integration CVE-2026-59293

Exploitation requires two concurrent conditions: first, the Spring Integration application must use the jCIFS SMB client adapter without explicitly setting smbMinVersion to enforce SMB2 or higher - this is the default behavior and therefore the vulnerable state for any unmodified Spring Integration SMB deployment in the affected version ranges; second, the attacker must be positioned on the network path between the Spring Integration client and the SMB server to intercept and manipulate the SMB dialect negotiation. Exploitation is bounded by the network adversary-in-the-middle requirement, which typically demands ARP spoofing, a rogue DHCP or DNS server, a compromised network device, or a co-located cloud tenant scenario. Deployments are not exploitable if smbMinVersion is explicitly configured to require SMB2 or higher, or if the target SMB server is configured to refuse SMB1 negotiation outright (for example, Windows Server 2019 and later with SMB1 disabled by default or via Group Policy).

The vendor-provided CVSS 6.6 (Medium) with vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H reflects high confidentiality and integrity impact substantially moderated by AC:H and PR:H. The PR:H metric warrants scrutiny: a classic MITM/NTLM-relay attack requires no authentication privileges on the target system; PR:H may reflect VMware's framing that a privileged operator must have omitted the smbMinVersion configuration rather than representing attacker-held credentials - this is an inconsistent use of the PR metric and should be verified against the vendor advisory. No EPSS score was available in sourced data. No CISA KEV listing exists and no CVE-specific public exploit has been identified, meaning no confirmed active exploitation at time of analysis. However, the underlying NTLM relay technique is extremely well-understood and implemented in widely available tools (Impacket ntlmrelayx, Responder), meaning any attacker who achieves the required MITM network position faces minimal technical barriers beyond gaining that position. Real-world priority is moderate-to-high for organizations using Spring Integration's SMB adapter over shared, cloud, or partially-trusted network segments, where the MITM requirement is more readily satisfied.

An attacker co-located on the same network segment - or having performed ARP spoofing, compromised a routing device, or occupied a co-located cloud tenant position - intercepts outbound SMB connections from a Spring Integration application that has not set smbMinVersion. The attacker's relay tool forces negotiation to SMB1/CIFS, then relays the captured NTLM authentication exchange to authenticate against an internal resource such as another file share, an Exchange server, or an intranet application supporting NTLM. No public proof-of-concept specific to CVE-2026-59293 is known, but the NTLM relay technique is widely implemented in tools such as Impacket's ntlmrelayx, requiring minimal attacker-side effort once MITM positioning is achieved.