AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VMwareCVE-2026-47858

VMware Spring Tools for: remote code execution

VMware

CVE-2026-47858 · Published Jul 30, 2026 · updated Sep 8, 2026

High8.0
No fix yet
VMware advisory

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution.

Affected Spring Products and Versions:

Spring Tools for Eclipse: 5.2.0 and earlier

Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Affected versions

PackageAffectedFixed in
Spring Tools for Eclipse
Product
<= 5.2.0No fix yet
Spring Tools for VSCode / Cursor / Theia
Product
<= 2.2.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-306

More VMware advisories

All VMware
Low 2.7Jul 30VMware ESX contains an insufficient logging vulnerabilityCVE-2026-41709fixed in 5.2.4 +3Critical 9.8Jul 30VMware Cloud Foundation: authentication bypassCVE-2026-59309fixed in 9.1.0.0300 +2Critical 9.8Jul 30VMware Cloud Foundation: path traversalCVE-2026-59310fixed in 9.1.0.0300 +2Critical 9.3Jul 30VMware Cloud Foundation: out-of-bounds writeCVE-2026-47876fixed in ESXi-9.1.0.0200-25557999 +2High 7.6Jul 30VMware Cloud Foundation: out-of-bounds readCVE-2026-41703fixed in 5.2.3 +4Low 3.3Jul 30VMware Spring Tools for: secrets in logsCVE-2026-59326no fix yet