widely-deployed-product-advisoryendpoint-software-vulnerabilityidentity-authentication-vulnerabilityinternet-exposed-service

Spring Tools Flaws Expose Developers to RCE, Open Debug Ports, and Weak Secrets

Patch & Detection Intelligence · 6 sources · Updated 3mo ago · First seen Jul 30, 2026

Spring disclosed and national cyber agencies amplified six vulnerabilities in Spring Tools that affect developer environments for the Spring Java ecosystem, including Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier. The most serious issues include CVE-2026-47858, which can expose Spring Boot applications started with live information mode to JMX-based remote code execution, and CVE-2026-47873, where the Boot Dashboard Docker integration publishes unauthenticated JDWP and JMX ports on 0.0.0.0 instead of limiting access to loopback, potentially exposing container control interfaces to the network.

A third high-severity flaw, CVE-2026-47882, weakens Spring Boot DevTools remote restart authentication by generating the shared secret with a non-cryptographic pseudo-random number generator. Advisories also cited additional issues involving plaintext logging of proxy credentials, cleartext storage of remote secrets, and a cross-site scripting vulnerability. Italy's ACN and the Canadian Centre for Cyber Security said updates are available or pending through Spring security bulletins, with fixed versions identified as Spring Tools for Eclipse 5.3.0 and Spring Tools for VSCode, Cursor, and Theia 2.3.0, and urged organizations to upgrade affected tooling.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jul 30, 2026

Reported Jul 30, 20263mo ago
Security updates released for affected Spring Tools products
Security updates were made available to address the six disclosed Spring Tools vulnerabilities. The notice says affected products are Spring Tools for Eclipse before 5.3.0 and Spring Tools for VSCode, Cursor, and Theia before 2.3.0, and recommends updating to fixed versions.
Risolte vulnerabilità in prodotti Spring - ACN
Jul 30, 20263mo ago
Canadian Centre for Cyber Security issues Spring vulnerability advisory
The Canadian Centre for Cyber Security issued advisory AV26-759 warning that multiple Spring developer tooling products were affected by several vulnerabilities as of July 30, 2026. The advisory directed users and administrators to review Spring security advisories and apply updates when available.
Spring security advisory (AV26-759) - Canadian Centre for Cyber Security
Jul 30, 20263mo ago
Spring publishes advisories for six Spring Tools vulnerabilities
Spring published security advisories covering six newly disclosed vulnerabilities in Spring Tools products, including remote code execution, exposed JDWP and JMX ports, weak secret generation, plaintext credential logging, cleartext secret storage, and cross-site scripting. The affected versions include Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier.
CVE-2026-47873 - Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
Jul 30, 20263mo ago
Spring receives CVE records for multiple Spring Tools vulnerabilities
VMware security received new CVE records for multiple vulnerabilities affecting Spring developer tooling, including CVE-2026-47882 and CVE-2026-47858. The issues include weak secret generation and JMX-based remote code execution conditions in Spring Tools products.
CVE-2026-47882 - Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

6 linked

Unauthenticated JDWP and JMX port exposure in Spring Tools Boot Dashboard Docker integration (CVE-2026-47873)Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips (CVE-2026-59328)JMX-based Remote Code Execution in Spring Tools Live Information Mode (CVE-2026-47858)Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations (CVE-2026-59327)HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server (CVE-2026-59326)Weak Spring Boot DevTools remote secret generation in Spring Tools for Eclipse (CVE-2026-47882)

Affected products

3 linked

CursorSpring Tools For EclipseSpring Tools For Vscode

Organizations

2 linked

SpringCursor

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Malware NewsNews · Jul 30, 2026

Spring security advisory (AV26-759) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Ca CcsNews · Jul 30, 2026

Spring security advisory (AV26-759) - Canadian Centre for Cyber SecurityOpen source ↗

Csirt ItaliaNews · Jul 30, 2026

Risolte vulnerabilità in prodotti Spring - ACNOpen source ↗

Cvefeed High SeverityAdvisories · Jul 30, 2026

CVE-2026-47882 - Spring Boot DevTools remote secret generated with a non-cryptographic PRNGOpen source ↗

Cvefeed High SeverityAdvisories · Jul 30, 2026

CVE-2026-47873 - Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfacesOpen source ↗

Cvefeed High SeverityAdvisories · Jul 30, 2026

CVE-2026-47858 - live information startup mode is vulnerable for remote code executionOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryendpoint-software-vulnerabilityidentity-authentication-vulnerabilityinternet-exposed-service

Spring Tools Flaws Expose Developers to RCE, Open Debug Ports, and Weak Secrets

Patch & Detection Intelligence · 6 sources · Updated 3mo ago · First seen Jul 30, 2026

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jul 30, 2026

Reported Jul 30, 20263mo ago
Security updates released for affected Spring Tools products
Security updates were made available to address the six disclosed Spring Tools vulnerabilities. The notice says affected products are Spring Tools for Eclipse before 5.3.0 and Spring Tools for VSCode, Cursor, and Theia before 2.3.0, and recommends updating to fixed versions.
Risolte vulnerabilità in prodotti Spring - ACN
Jul 30, 20263mo ago
Canadian Centre for Cyber Security issues Spring vulnerability advisory
The Canadian Centre for Cyber Security issued advisory AV26-759 warning that multiple Spring developer tooling products were affected by several vulnerabilities as of July 30, 2026. The advisory directed users and administrators to review Spring security advisories and apply updates when available.
Spring security advisory (AV26-759) - Canadian Centre for Cyber Security
Jul 30, 20263mo ago
Spring publishes advisories for six Spring Tools vulnerabilities
Spring published security advisories covering six newly disclosed vulnerabilities in Spring Tools products, including remote code execution, exposed JDWP and JMX ports, weak secret generation, plaintext credential logging, cleartext secret storage, and cross-site scripting. The affected versions include Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier.
CVE-2026-47873 - Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
Jul 30, 20263mo ago
Spring receives CVE records for multiple Spring Tools vulnerabilities
VMware security received new CVE records for multiple vulnerabilities affecting Spring developer tooling, including CVE-2026-47882 and CVE-2026-47858. The issues include weak secret generation and JMX-based remote code execution conditions in Spring Tools products.
CVE-2026-47882 - Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

Linked entities