{"id":"CVE-2026-47861","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-47861","generatedAt":"2026-10-28T02:21:01.908Z","title":"An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.","description":"An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12\nSpring Integration 5.5.21 and earlier","published":"2026-08-27T01:17:33.000Z","lastModified":"2026-09-02T16:28:35.000Z","status":"Analyzed","sourceIdentifier":"security@vmware.com","cvss":{"version":"3.1","score":6.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},"cwe":["CWE-918"],"affected":["vmware/spring integration"],"epss":{"score":0.00327,"percentile":0.25591,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://spring.io/security/cve-2026-47861","tags":["Vendor Advisory"],"source":"security@vmware.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-47861","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}