Insecure Default Initialization of Resource in Spring Integration - CVE-2026-59293
Published: August 28, 2026
Vulnerability identifier: #VU146207
CSH Severity: Low
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59293
CWE-ID: CWE-1188
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to intercept or alter transferred files and capture NTLM credentials.
The vulnerability exists due to insecure default configuration in the SMB adapter jCIFS client configuration when negotiating the SMB protocol dialect. A remote privileged user can downgrade the connection to smb1/cifs in a machine-in-the-middle position to intercept or alter transferred files and capture NTLM credentials.
The issue occurs unless the application explicitly raises smbMinVersion.
Affected software
Spring Integration
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59293
Install security update from vendor's website.
Spring Integration - addressed in versions 6.4.13, 6.5.11, 7.0.5.1, 7.0.6, 7.1.0.1, 7.1.1
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19