CVE-2026-47858 — live information startup mode is vulnerable for remote code execution

CVE-2026-47858

live information startup mode is vulnerable for remote code execution PUBLISHED

Description (CNA)

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring Tools for Eclipse	affected 0 through 5.2.0
Spring / Spring Tools for VSCode / Cursor / Theia	affected 0 through 2.2.0

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47858

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.