EUVD-2026-67192
GHSA-7336-836q-wfv9
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Consistent with vendor vector: Spring-managed bean configuration creates high-complexity precondition, operator-level auth required to write to the store, and scope change reflects deserialization RCE potentially escaping JVM to host.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
AnalysisAI
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to be simultaneously true: first, the JdbcMessageStore must be declared as a Spring-managed bean (e.g., via @Bean or XML application context - not instantiated manually outside Spring's lifecycle); second, the operator must have explicitly called addAllowedPatterns() on that bean with the intent of restricting deserialization (this is the configuration state where the bypass activates and protection silently fails); third, the attacker must hold authenticated access sufficient to write data to the JDBC message store, consistent with the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) correctly reflects full CIA impact when exploited, but the High attack complexity and High privilege requirement are the critical moderating factors for real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the vendor advisory at https://spring.io/security/cve-2026-59307 for confirmed patched release versions - specific fixed version numbers are not independently confirmed from the available input data and must be retrieved directly from VMware/Spring. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Spring Integration 6.4.x through 7.1.0 with JDBC message stores and document their business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today