CVE-2026-47858: live information startup mode is vulnerable for remote code execution
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Tools for Eclipseto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
Spring Tools for VSCode / Cursor / Theiato a version that resolves this vulnerability.Fixed in 2.2.0 - Configuration
Do not start Spring Boot applications using Spring Tools live information startup mode; start without live information enabled to avoid JMX-based remote code execution exposure.
Spring Tools live information startup mode = disable (turn off live information mode for starting Spring Boot applications)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47858?
CVE-2026-47858 has a high severity rating of 8.
What vulnerabilities does CVE-2026-47858 introduce?
CVE-2026-47858 introduces a risk of remote code execution due to JMX-based vulnerabilities when live information mode is enabled.
How do I fix CVE-2026-47858?
To mitigate CVE-2026-47858, disable the live information startup mode in your Spring Boot applications.
Which Spring products are affected by CVE-2026-47858?
CVE-2026-47858 affects Spring Tools for Eclipse versions 5.2.0 and earlier, as well as Spring Tools for VSCode, Cursor, and Theia.
Can CVE-2026-47858 be exploited remotely?
Yes, CVE-2026-47858 can be exploited remotely if the live information startup mode is enabled.