CVE-2026-40987

HIGH EPSS 11.2%
Published Jun 11, 20262w ago · Modified Jun 23, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Jun 11, 2026 2w ago
Last Modified Jun 23, 2026 1w ago

Description

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

CVSS Details

Base Score
7.1
Exploitability
1.3
Impact
5.3
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity High
Availability Low

Threat Intelligence

EPSS Exploit Probability
11.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 1

  • spring.io https://spring.io/security/cve-2026-40987

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.