CVE-2026-47858

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Affected products

Spring Boot, Spring Tools For Cursor, Spring Tools For Eclipse, Spring Tools For Theia, Spring Tools For Vscode

CVSS 3.1

8.0 HIGH

EPSS

0.2% (10th percentile)

Weakness

CWE-306

NVD status

Awaiting Analysis

Published

2026-07-30