EUVD-2026-50970
GHSA-qhpg-2hp9-2j5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network position
-
ExploitDiscover exposed JMX/RMI port on developer host
-
ExecutionRegister or invoke malicious MBean
-
ImpactExecute arbitrary code in developer context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target developer launch a Spring Boot application through Spring Tools with the 'live information' mode explicitly enabled - this is the exact configuration prerequisite named in the description, and without it no JMX endpoint is exposed. The attacker must be positioned on the adjacent network (AV:A) able to reach the developer's machine and its JMX/RMI port. Limiting factors: the vulnerability is gated by developer action (UI:R - the app must be started in live mode), it is confined to affected extension versions (Eclipse ≤5.2.0, VSCode/Cursor/Theia ≤2.2.0), and it is not remotely exploitable across the internet by default, substantially narrowing realistic exposure to shared-LAN scenarios. |
| Impact | The CVSS vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.0) indicates an adjacent-network, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact, but gated by required user interaction - the developer must start the app in live mode. The AV:A (adjacent) rather than AV:N (network) meaningfully limits blast radius: the attacker must share the local network/broadcast domain with the developer's machine, so this is not internet-wide exploitable by default. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so the practical exploitation probability cannot be quantified from the input and there is no evidence of active exploitation. Net assessment: a genuinely high-severity RCE for developer workstations in shared/office network environments, but the adjacent vector plus user-interaction requirement make it a targeted rather than mass-exploitable issue; missing EPSS/POC data means real-world likelihood is unconfirmed. |
| Exploit ScenarioDerived | A developer on a shared corporate or coworking Wi-Fi network starts a Spring Boot application from their IDE with live information mode enabled, silently exposing a JMX endpoint. An attacker on the same network segment discovers the open JMX/RMI port, registers or invokes a malicious MBean, and executes arbitrary code on the developer's workstation. No public exploit code is identified at time of analysis, though JMX RCE techniques are well documented publicly. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory (https://spring.io/security/cve-2026-47858): upgrade Spring Tools for Eclipse beyond 5.2.0 and Spring Tools for VSCode/Cursor/Theia beyond 2.2.0 to the fixed releases - the exact fixed version numbers are not stated in the provided data and should be confirmed against the spring.io advisory before deployment. As an interim workaround, disable the 'live information' mode in the Spring Tools extension so applications are not launched with the exposed JMX server (trade-off: developers lose real-time bean/mapping/metrics introspection in the IDE). Additionally, developers should avoid running live-mode-enabled Spring Boot apps on untrusted or shared networks and can restrict JMX exposure by binding it to localhost or firewalling the JMX/RMI ports so adjacent hosts cannot reach them (trade-off: may block legitimate remote monitoring tooling).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring Tools provides IDE integrations (Eclipse, VSCode, Cursor, Theia) for Spring Boot development; its 'live information' feature connects the IDE to a running application to display real-time bean, mapping, and metrics data, and it does this over JMX (Java Management Extensions). When live mode is enabled, the Spring Boot process is started with a JMX server that, in the vulnerable configuration, is reachable without adequate authentication. JMX-based RCE typically stems from the ability to invoke or register MBeans (e.g., loading a remote MLet or abusing management operations), a root-cause class aligned with unsafe management-interface exposure and Java deserialization (CWE-502 / CWE-749); the official CVE assigns no CWE, so this classification is inferred rather than vendor-confirmed.
Know when Spring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Adjacent-network JMX exposure (AV:A), no attacker privileges (PR:N), but the developer must enable live mode and launch the app (UI:R); full RCE yields C/I/A High.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
DescriptionCVE.org
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Articles & Coverage 1
Executive ViewAI
Spring Tools IDE extensions pose remote code execution risk to developer workstations through their live monitoring feature, potentially compromising source code, development credentials, and software build pipelines. Development teams using affected versions (Eclipse ≤5.2.0, VSCode/Cursor ≤2.2.0) are exposed to network-based attacks when this feature is enabled. Immediate mitigation is required to protect critical development infrastructure and prevent supply chain compromise.
Disable live information monitoring mode in Spring Tools IDE until vendor-released patches become available; implement network firewall rules to restrict JMX port access on development workstations to authorized administrative networks; isolate development environments on segregated network segments; maintain active monitoring of Spring Tools security advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.
Exploit-DB