Loading vulnerability…
JMX-based Remote Code Execution in Spring Tools Live Information Mode
CVE-2026-47858 is a remote code execution vulnerability in Spring Tools that affects Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier. When a Spring Boot application is started from affected Spring Tools with live information mode enabled, the running application becomes exposed to JMX-based remote code execution. The issue arises from the way live information startup mode configures or exposes JMX functionality, allowing an attacker to reach a management interface that should not be remotely exploitable. The vulnerability affects the launched application context rather than only the IDE itself, and successful exploitation can result in arbitrary code execution within the security context of the targeted Spring Boot application process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows remote code execution against the affected running Spring Boot application. The published CVSS v3.1 vector indicates high impact to confidentiality, integrity, and availability, consistent with an attacker being able to execute arbitrary code, access or modify application data, alter application behavior, and disrupt service availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable live information mode when starting Spring Boot applications from Spring Tools. Restrict exposure of JMX management interfaces to trusted local-only access and prevent unintended network reachability through host firewalling, interface binding controls, segmentation, and developer workstation hardening. Avoid using affected tooling configurations in environments where untrusted adjacent-network access is possible.
Patch, then assume compromise.
Upgrade to a fixed release newer than Spring Tools for Eclipse 5.2.0 and newer than Spring Tools for VSCode, Cursor, and Theia 2.2.0. Where possible, stop launching Spring Boot applications with vulnerable Spring Tools versions in live information mode. Apply vendor-provided updates from the Spring project as they become available and redeploy or relaunch affected applications using the corrected tooling.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.