VMware Spring Integration vulnerabilities

17 CVEs affecting VMware Spring Integration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59324, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-47864, published 2026-08-27. Critical severity, CVSS 9.8. EPSS: 5.9% chance of exploitation in the next 30 days. SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type…
CVE-2020-5413, published 2020-07-31. Critical severity, CVSS 9.8. EPSS: 4.4% chance of exploitation in the next 30 days. Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on…
CVE-2019-3772, published 2019-01-18. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE)…
CVE-2026-59274, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a…
CVE-2026-59307, published 2026-08-27. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring…
CVE-2026-59311, published 2026-08-27. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application…
CVE-2026-47861, published 2026-08-27. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or…
CVE-2026-47856, published 2026-08-27. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no…
CVE-2026-47862, published 2026-08-27. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem…
CVE-2026-59322, published 2026-08-27. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON…

Latest

CVE-2026-59324, published 2026-08-27. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply…
CVE-2026-59321, published 2026-08-27. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message…
CVE-2026-59293, published 2026-08-27. Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days. Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and…
CVE-2026-59292, published 2026-08-27. Low severity, CVSS 3.2. EPSS: 0.1% chance of exploitation in the next 30 days. PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable…
CVE-2026-47880, published 2026-08-27. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are…