Loading story…
Spring disclosed and national cyber agencies amplified six vulnerabilities in Spring Tools that affect developer environments for the Spring Java ecosystem, including Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier. The most serious issues include CVE-2026-47858, which can expose Spring Boot applications started with live information mode to JMX-based remote code execution, and CVE-2026-47873, where the Boot Dashboard Docker integration publishes unauthenticated JDWP and JMX ports on 0.0.0.0 instead of limiting access to loopback, potentially exposing container control interfaces to the network.
A third high-severity flaw, CVE-2026-47882, weakens Spring Boot DevTools remote restart authentication by generating the shared secret with a non-cryptographic pseudo-random number generator. Advisories also cited additional issues involving plaintext logging of proxy credentials, cleartext storage of remote secrets, and a cross-site scripting vulnerability. Italy's ACN and the Canadian Centre for Cyber Security said updates are available or pending through Spring security bulletins, with fixed versions identified as Spring Tools for Eclipse 5.3.0 and Spring Tools for VSCode, Cursor, and Theia 2.3.0, and urged organizations to upgrade affected tooling.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-759 warning that multiple Spring developer tooling products were affected by several vulnerabilities as of July 30, 2026. The advisory directed users and administrators to review Spring security advisories and apply updates when available.
Spring published security advisories covering six newly disclosed vulnerabilities in Spring Tools products, including remote code execution, exposed JDWP and JMX ports, weak secret generation, plaintext credential logging, cleartext secret storage, and cross-site scripting. The affected versions include Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier.
VMware security received new CVE records for multiple vulnerabilities affecting Spring developer tooling, including CVE-2026-47882 and CVE-2026-47858. The issues include weak secret generation and JMX-based remote code execution conditions in Spring Tools products.
Security updates were made available to address the six disclosed Spring Tools vulnerabilities. The notice says affected products are Spring Tools for Eclipse before 5.3.0 and Spring Tools for VSCode, Cursor, and Theia before 2.3.0, and recommends updating to fixed versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spring published advisories for four vulnerabilities affecting its ecosystem, including three flaws in auto-configuration for **Elasticsearch**, **Cassandra**, and **RabbitMQ** that can disable TLS hostname verification when an SSL bundle is used. The issues are tracked as `CVE-2026-40970`, `CVE-2026-40974`, and `CVE-2026-40971`, respectively, and could weaken certificate validation for connections to those backend services. A fourth advisory, `CVE-2026-40972`, affects **Spring DevTools** and states that remote secret comparison is vulnerable to timing attacks. Together, the disclosures highlight risks in both transport security and authentication-related logic, with the TLS-related bugs potentially exposing applications to man-in-the-middle scenarios and the DevTools issue creating an avenue for attackers to infer secrets through response timing differences.
Jun 29, 2026
Broadcom published a large set of Spring security advisories affecting Spring Framework and related projects, with Sonatype tracking **91 CVEs** and identifying **209,569 affected software components** at the time of publication. The disclosures span multiple vulnerability classes, including insecure deserialization, untrusted code execution under certain conditions, sensitive information exposure, SSRF, path traversal, denial of service, and improper authorization, creating a significant downstream remediation burden for organizations that embed vulnerable Spring components indirectly through other software. Among the most serious issues, **`CVE-2026-59285`** in **Spring for GraphQL** was highlighted as a critical unsafe deserialization flaw that can lead to remote code execution in specific scenarios, while **`CVE-2026-59318`** in **Spring AI** was described as a prompt-injection-related tool-calling boundary bypass that could enable privilege escalation. Spring’s security advisory portal published the vendor notices, and defenders were urged to inventory Spring versions across their environments, determine real exposure and exploitability, and move affected systems to fixed releases as quickly as possible.
Aug 28, 2026
The Canadian Centre for Cyber Security issued advisory **AV26-288** warning that multiple vulnerabilities disclosed by Spring affect **Spring Cloud Config** and **Spring AI**, including **server-side request forgery (SSRF)**, unintended file access, query injection, and a **SpEL injection** that can lead to **remote code execution (RCE)**. The notice says the issues were disclosed by Spring between March 23 and 26 and urged organizations to review the vendor advisories and assess exposure in affected deployments. Affected versions include **Spring Cloud Config** releases prior to **3.1.3**, **4.1.9**, **4.2.6**, **4.3.2**, and **5.0.2**, along with **Spring AI** versions prior to **1.0.5** and **1.1.4**. The Cyber Centre advised administrators and users to apply the relevant updates to reduce the risk of exploitation against exposed services and vulnerable application environments.
Jun 29, 2026