VMware Spring Data Gemfire vulnerabilities

2 CVEs affecting VMware Spring Data Gemfire, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-2818, published 2026-02-20.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-2818, published 2026-02-20. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to…
• CVE-2026-2817, published 2026-02-19. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic…