CVE-2026-59270

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.40%
EPSS Percentile: 33.58%
CISA KEV: Not listed

Description

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 27-Aug-2026 13:17
Last Modified: 02-Sep-2026 03:36
EPSS Date: 2026-10-23
CWE: CWE-863

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

Affected Products / Versions

vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.7.0 · before (exclusive) 5.7.26
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.8.0 · before (exclusive) 5.8.28
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.4.0 · before (exclusive) 6.4.19
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.5.0 · before (exclusive) 6.5.12
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.0.0 · before (exclusive) 7.0.6.1
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.1.0 · before (exclusive) 7.1.0.1
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 02-Nov-2026 09:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

A single vulnerability has been assigned a critical severity rating: CVE-2026-59270. Spring Framework Updates Patch 91 Vulnerabilities

CVE (2)

Vendors (1)

Products (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.