Spring Integration SMB1 Downgrade via jCIFS Client (v6.4-7.1)
CVE-2026-59293 Published on August 27, 2026

SMB minimum protocol dialect defaults to SMB1
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

NVD

Vulnerability Analysis

CVE-2026-59293 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Products Associated with CVE-2026-59293

Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.

VMware Spring Framework
 

Affected Versions

Spring Integration: