Vulnerability Details CVE-2026-47861
An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 16.4%
CVSS Severity
CVSS v3 Score 6.3
References
Products affected by CVE-2026-47861
-
cpe:2.3:a:vmware:spring_integration:6.4.0
-
cpe:2.3:a:vmware:spring_integration:6.4.1
-
cpe:2.3:a:vmware:spring_integration:6.4.10
-
cpe:2.3:a:vmware:spring_integration:6.4.11
-
cpe:2.3:a:vmware:spring_integration:6.4.12
-
cpe:2.3:a:vmware:spring_integration:6.4.2
-
cpe:2.3:a:vmware:spring_integration:6.4.3
-
cpe:2.3:a:vmware:spring_integration:6.4.4
-
cpe:2.3:a:vmware:spring_integration:6.4.5
-
cpe:2.3:a:vmware:spring_integration:6.4.6
-
cpe:2.3:a:vmware:spring_integration:6.4.7
-
cpe:2.3:a:vmware:spring_integration:6.4.8
-
cpe:2.3:a:vmware:spring_integration:6.4.9
-
cpe:2.3:a:vmware:spring_integration:6.5.0
-
cpe:2.3:a:vmware:spring_integration:6.5.1
-
cpe:2.3:a:vmware:spring_integration:6.5.10
-
cpe:2.3:a:vmware:spring_integration:6.5.2
-
cpe:2.3:a:vmware:spring_integration:6.5.3
-
cpe:2.3:a:vmware:spring_integration:6.5.4
-
cpe:2.3:a:vmware:spring_integration:6.5.5
-
cpe:2.3:a:vmware:spring_integration:6.5.6
-
cpe:2.3:a:vmware:spring_integration:6.5.7
-
cpe:2.3:a:vmware:spring_integration:6.5.8
-
cpe:2.3:a:vmware:spring_integration:6.5.9
-
cpe:2.3:a:vmware:spring_integration:7.0.0
-
cpe:2.3:a:vmware:spring_integration:7.0.1
-
cpe:2.3:a:vmware:spring_integration:7.0.2
-
cpe:2.3:a:vmware:spring_integration:7.0.3
-
cpe:2.3:a:vmware:spring_integration:7.0.4
-
cpe:2.3:a:vmware:spring_integration:7.0.5