CVE-2026-47858

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Spring Tools with Live Information Mode

Publication date: 2026-07-30

Last updated on: 2026-08-01

Assigner: VMware

Description

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-01

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-47858

EUVD

EUVD-2026-50970

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_tools_for_eclipse	to 5.2.0 (exc)
vmware	spring_tools_for_vscode	to 2.2.0 (exc)
vmware	spring_tools_for_eclipse	to 5.2.0 (inc)
vmware	spring_tools_for_vscode	to 2.2.0 (inc)
vmware	spring_tools_for_cursor	to 2.2.0 (inc)
vmware	spring_tools_for_theia	to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows remote code execution in Spring Boot applications started in live information mode within Spring Tools. It occurs due to JMX-based remote code execution risks in the live information feature of affected IDEs.

Detection Guidance

Check if Spring Tools versions are affected by running the IDE and inspecting the version in the about section. For Eclipse, go to Help > About Spring Tools. For VSCode/Cursor/Theia, check the extensions view. Alternatively, run commands like 'spring --version' or check installed plugins in the IDE.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your system if you run a vulnerable Spring Boot application in live information mode. This could lead to data breaches, system compromise, or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Upgrade to Spring Tools for Eclipse 5.3.0 or Spring Tools for VSCode/Cursor/Theia 2.3.0. As a temporary measure, disable the live information feature when starting Spring Boot applications from the IDE.

Hi! I’m here to help you understand CVE-2026-47858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70