EUVD-2026-66839
GHSA-mvcx-qg6f-j67g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain write access to untrusted job-repository data source
-
DeliveryStore crafted execution context with Jackson gadget payload
-
ExploitApplication deserializes context via Jackson2ExecutionContextStringSerializer
-
ExecutionJobParameterDeserializer bypasses trusted-types allowlist
-
PersistGadget class instantiated
-
ImpactArbitrary code executes in batch process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two specific conditions both present: the application must serialize/deserialize execution contexts using Jackson2ExecutionContextStringSerializer, AND the job repository must draw from an untrusted data source that the attacker can influence (i.e. the attacker can plant crafted execution-context data that will later be deserialized). Limiting factors: applications using the default trusted, application-owned job repository, or a different ExecutionContext serializer, are not exploitable; the attacker needs a write path into the repository/data source, so this is not pure drive-by network RCE despite the AV:N/PR:N CVSS vector. A suitable Jackson gadget class must also be present on the application classpath for full code execution. |
| Impact | Signals conflict and should be weighed carefully. The CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) treats this as trivially exploitable network RCE, but the description makes clear a precondition: the application must both use Jackson2ExecutionContextStringSerializer and read execution contexts from an untrusted data source. That is not a default posture, which is why EPSS is low (0.25%, 16th percentile) and CISA SSVC rates Exploitation: none, Automatable: no, Technical Impact: partial. There is no KEV listing and no public PoC referenced. Net: this is a genuinely serious flaw for the subset of deployments that expose their job repository to untrusted writes, but for the majority running a trusted, application-owned repository the realistic risk is materially lower than the raw 9.8 suggests. Treat as high-priority for at-risk configurations and standard patch-cycle otherwise. Note the CVSS PR:N/AC:L likely understates the attacker's need to write into the repository data source - verify against your deployment. |
| Exploit ScenarioDerived | An attacker gains the ability to write into the data source that feeds a Spring Batch job repository (for example a shared or multi-tenant database, or an ingestion path that populates execution-context state). They insert a crafted serialized execution context embedding a Jackson RCE gadget class; when the batch application next deserializes that context via Jackson2ExecutionContextStringSerializer, the JobParameterDeserializer instantiates the malicious type and arbitrary code runs in the batch process. No public PoC is currently referenced, but the underlying Jackson gadget technique is well documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 02, 2026
Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity.
Earlier versions of this analysis (1)
Arbitrary code execution via Jackson deserialization affects Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 when applications use Jackson2ExecutionContextStringSerializer and read job execution contexts from an untrusted data source. The JobParameterDeserializer's failure to enforce Jackson's trusted-types allowlist exposes the application to well-known Jackson polymorphic deserialization gadget chains, which can yield full remote code execution on the batch server. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the exploitation technique leverages established RCE primitives broadly understood by attackers targeting Java environments.
RemediationAI
Upgrade Spring Batch to a fixed release in your branch as directed by the Spring advisory at https://spring.io/security/cve-2026-47875 - the input data does not include an exact patched version, so confirm the fixed build from that advisory before deploying (no independently confirmed fix version at time of analysis). As compensating controls until patched: ensure the JobRepository is backed only by a trusted, application-controlled data store and that no untrusted party can write execution-context rows (this is the core precondition, and removing untrusted write access largely neutralizes the attack); avoid or replace Jackson2ExecutionContextStringSerializer where feasible, or constrain Jackson polymorphic typing by configuring a strict trusted-types allowlist / PolymorphicTypeValidator so unexpected gadget classes cannot be instantiated (trade-off: may break legitimate custom types stored in execution contexts, requiring testing). Also restrict and monitor database access to the batch metadata tables. Consult the ENISA EUVD (EUVD-2026-66839) and NVD entries for cross-referenced fix details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring Batch is Broadcom/VMware's Java framework for building large-volume batch processing jobs; it persists job and step ExecutionContext state to a JobRepository (typically a relational database). To store rich object state as text, it can use Jackson2ExecutionContextStringSerializer, which serializes/deserializes context maps via Jackson. The root cause is CWE-502 (deserialization of untrusted data): the JobParameterDeserializer does not properly apply Jackson's trusted-types / polymorphic-type allowlist, so type information embedded in the serialized payload is honored during read-back. Jackson's default typing and gadget-class instantiation are the same mechanism behind the well-documented Jackson-databind RCE gadget chains, meaning a malicious payload stored in the repository is materialized into attacker-chosen classes when the context is deserialized. The CPE identifies the affected component as cpe:2.3:a:broadcom:spring_batch across the listed version ranges.
Know when Spring Batch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Full RCE impact once triggered, but exploitation depends on a non-default serializer plus attacker-influenceable untrusted repository data, raising attack complexity to AC:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
Executive ViewAI
Spring Batch versions 5.2.0-5.2.6 and 6.0.0-6.0.4 contain a remote code execution vulnerability in deserialization logic that allows arbitrary code execution when job repositories are backed by untrusted data sources. No public exploit identified at time of analysis; however, the vulnerability's critical severity and absence of vendor patches pose substantial risk to production batch processing environments.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to job repository backends to prevent adversary data modification; implement strict deserialization allowlists and input validation at repository layer; monitor job execution contexts for anomalous patterns; segment batch processing systems from critical infrastructure; and maintain active coordination with VMware/Spring for patch status and availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Spring Batch
View allSpring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injec
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary
Uncontrolled resource consumption in Spring Batch's FlatFileItemReader allows denial-of-service against batch jobs that
Unsafe Java deserialization in Spring Batch's DefaultExecutionContextSerializer exposes the JDBC job repository to poten
Exploit-DB