CVE-2026-2817: VMware Spring Data Gemfire

Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days.

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.

Affected products

• VMware Spring Data Gemfire: from 1.7.0.RELEASE, up to and including 2.2.13.RELEASE
• VMware Spring Data Geode: from 2.0.0.RELEASE, up to and including 2.7.18

Published 2026-02-19. Last modified 2026-06-17.