CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
Spring Integration defaults to insecure SMB1, allowing attackers to bypass signing and encryption via NTLM relay or MITM attacks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59293?
CVE-2026-59293 is a medium-severity vulnerability in Spring Integration, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Weakness: CWE-757
Which versions are affected by CVE-2026-59293?
It affects 1 product.
Products include Vmware Spring Integration.
How do I fix CVE-2026-59293?
Upgrade to a fixed version.
Is CVE-2026-59293 being exploited?
There is no known exploitation of CVE-2026-59293 in the wild and no public exploit code.
Other vulnerabilities in Spring Integration
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS
Sources
Also known as GHSA-5v9f-jcmr-jg2q.