« Volver al listado

CVE-2026-47861

Estado: AnalizadaMedia (6.3)—

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Vmware — Spring Integration

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-27T13:13:04.986478Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Integration",
          "versions": [
            {
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.0.5"
            },
            {
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.5.10"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.12"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "5.5.21"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-27T01:17:33.157",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-47861",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12\nSpring Integration 5.5.21 and earlier"
    }
  ],
  "lastModified": "2026-09-02T16:28:35.403",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A24A3363-22EB-428E-9F63-0CA6FA7301E9",
              "versionEndExcluding": "5.5.22"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3145A7D2-7890-40CA-8B12-842EE4729278",
              "versionEndExcluding": "6.4.13",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE232825-C8FF-465D-964B-110CB09C6EE4",
              "versionEndExcluding": "6.5.11",
              "versionStartIncluding": "6.5.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F075888D-6CE0-4462-84ED-1FD348EED24A",
              "versionEndExcluding": "7.0.5.1",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F9FA670-735A-46AC-BF7F-68BDEBA464B3",
              "versionEndExcluding": "7.1.0.1",
              "versionStartIncluding": "7.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}