CVE-2026-59270

9.1 criticalEPSS 0.4%

Critical (9.1) in vmware spring security. EPSS 0.4% chance of exploitation in the next 30 days.

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-08-27
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

Affected

vmware:spring_security

References

https://spring.io/security/cve-2026-59270

Check your stack JSON