Vulnerability · Published Jul 30, 2026 · Assigned by vmware
CVE-2026-47858live information startup mode is vulnerable for remote code execution
High 8.0
In plain English
A high-severity missing authentication in Spring Tools for Eclipse from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Tools for Eclipse | 0 – through 5.2.0 |
| Spring | Spring Tools for VSCode / Cursor / Theia | 0 – through 2.2.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H