CVE-2026-47858: Spring Tools JMX-Based RCE Vulnerability

CVE-2026-47858 Overview

CVE-2026-47858 affects Spring Tools when developers start Spring Boot applications with live information mode enabled. The feature exposes a Java Management Extensions (JMX) endpoint on the running application. An attacker on the same adjacent network can reach that endpoint and invoke management operations that lead to remote code execution on the developer's machine.

The issue affects Spring Tools for Eclipse versions 5.2.0 and earlier, and Spring Tools for VSCode, Cursor, and Theia versions 2.2.0 and earlier. See the Spring Security Advisory CVE-2026-47858 for vendor details.

Critical Impact
An attacker with adjacent network access can execute arbitrary code on a developer workstation running a Spring Boot application launched with live information mode.

Affected Products

Spring Tools for Eclipse 5.2.0 and earlier
Spring Tools for VSCode 2.2.0 and earlier
Spring Tools for Cursor and Theia 2.2.0 and earlier

Discovery Timeline

2026-07-30 - CVE-2026-47858 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-47858

Vulnerability Analysis

Spring Tools includes a live information mode that connects the IDE to running Spring Boot applications and streams bean, endpoint, and metrics data back to the developer. To collect this telemetry, Spring Tools launches the target application with a JMX connector attached. The JMX connector listens on a network port without authentication when started under this mode.

Any host that can reach the JMX port can enumerate registered MBeans and invoke their operations. JMX exposes MBeans that permit class loading and reflective method invocation. An attacker can chain these operations to load an attacker-supplied class and execute arbitrary Java code inside the JVM.

Because the application runs in the developer's user context, the attacker inherits the developer's local privileges, source code access, and any credentials cached by the IDE. This vulnerability is classified as insecure default configuration leading to remote code execution.

Root Cause

The root cause is an insecure default configuration in the Spring Tools launcher. When live information mode is enabled, the JMX endpoint is bound without authentication or transport layer security. The launcher does not restrict the bind address to loopback, so the port becomes reachable from any host on the same broadcast domain.

Attack Vector

Exploitation requires adjacent network access, user interaction to start the application in live mode, and no privileges on the target system. The attack surface includes developer workstations, shared office networks, corporate Wi-Fi, and CI runners on flat network segments. The attacker connects to the exposed JMX port and issues MBean operations that load a remote class and execute a payload.

No verified public exploit code is available. Refer to the Spring Security Advisory CVE-2026-47858 for further technical detail.

Detection Methods for CVE-2026-47858

Indicators of Compromise

Unexpected outbound network connections initiated by java.exe or java processes launched from Spring Tools.
Child processes spawned from the JVM that are not part of the normal Spring Boot lifecycle, such as cmd.exe, powershell.exe, or /bin/sh.
New listening sockets bound to non-loopback interfaces on developer workstations for JMX/RMI ports.

Detection Strategies

Inspect command lines of Java processes for com.sun.management.jmxremote flags combined with jmxremote.authenticate=false and non-loopback host bindings.
Alert on JVM processes loading classes from remote codebases via RMIClassLoader or MLet MBeans.
Correlate developer endpoint process telemetry with unusual inbound TCP sessions on ephemeral ports followed by shell or scripting engine execution.

Monitoring Recommendations

Monitor Spring Tools launch configurations across developer fleets and flag any that enable live information mode on untrusted networks.
Log and review network flows on developer VLANs for peer-to-peer connections to high-numbered ports on workstations.
Baseline expected child-process trees for Spring Boot applications and alert on deviations.

How to Mitigate CVE-2026-47858

Immediate Actions Required

Upgrade Spring Tools for Eclipse to a version later than 5.2.0.
Upgrade Spring Tools for VSCode, Cursor, and Theia to a version later than 2.2.0.
Disable live information mode on any developer workstation that cannot be upgraded immediately.
Restrict developer workstations to trusted network segments and block inbound connections to JMX/RMI ports at the host firewall.

Patch Information

Spring has published fixed versions of Spring Tools. Consult the Spring Security Advisory CVE-2026-47858 for the exact fixed release numbers and download locations. Apply the update through the standard Eclipse Marketplace or the respective VSCode, Cursor, or Theia extension marketplace.

Workarounds

Launch Spring Boot applications without the live information toggle when working on untrusted or shared networks.
Bind JMX explicitly to 127.0.0.1 and require authentication and TLS for any required remote management access.
Use host-based firewall rules to deny inbound traffic to Java processes on developer machines.

bash

# Configuration example - bind JMX to loopback with authentication
-Dcom.sun.management.jmxremote=true \
-Dcom.sun.management.jmxremote.host=127.0.0.1 \
-Dcom.sun.management.jmxremote.port=0 \
-Dcom.sun.management.jmxremote.authenticate=true \
-Dcom.sun.management.jmxremote.ssl=true