CVE-2026-47858: live information startup mode is vulnerable for remote code execution

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-30 · updated 2026-09-08
Weakness: CWE-306

Description

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Affected products

Spring Tools for Eclipse: before 2.3.0; before 5.3.0 — fixed in 2.3.0, 5.3.0

How to fix

Upgrade to a fixed version: Spring Tools for Eclipse 2.3.0, 5.3.0. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47858

Get alerted when CVE-2026-47858 or the next vulnerability affects your stack