CVE-2026-59283 Spring Framework Safety Guard Bypass via SpEL Expression Compilation

Critical 9.1 Published 27 Aug 2026 Updated 28 Aug 2026

Attackers can bypass SpEL safety guards to execute arbitrary code if the expression compiler is enabled in Spring Framework applications.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59283?

CVE-2026-59283 is a critical code injection vulnerability in Vmware Spring Framework, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Weakness: CWE-913

Which versions are affected by CVE-2026-59283?

It affects 1 product.

Products include Vmware Spring Framework.

How do I fix CVE-2026-59283?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-59283 being exploited?

There is no known exploitation of CVE-2026-59283 in the wild and no public exploit code.

All Vmware Spring Framework vulnerabilities

Sources

Also known as CLEANSTART-2026-IP81999, CLEANSTART-2026-JL35312, CLEANSTART-2026-MN75797, CLEANSTART-2026-SX10115, DEBIAN-CVE-2026-59283, GHSA-m843-fc87-4v2m and 1 more.