CVE-2026-59270CWE-863broken-access-control

CVE-2026-59270

Critical · published August 27, 2026

CVSS v3.1
9.4
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.

Spring Security 7.1.0

Spring Security 7.0.0 - 7.0.6

Spring Security 6.5.0 - 6.5.11

Spring Security 6.4.0 - 6.4.18

Spring Security 5.8.0 - 5.8.27

Spring Security 5.7.0 - 5.7.25

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-27T10:17Z
Affected products (6)
ProductVersionsFixed in
vmware/spring_security≥ 5.7.0, < 5.7.265.7.26
vmware/spring_security≥ 5.8.0, < 5.8.285.8.28
vmware/spring_security≥ 6.4.0, < 6.4.196.4.19
vmware/spring_security≥ 6.5.0, < 6.5.126.5.12
vmware/spring_security≥ 7.0.0, < 7.0.6.17.0.6.1
vmware/spring_security≥ 7.1.0, < 7.1.0.17.1.0.1
References (1)
https://spring.io/security/cve-2026-59270 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 27 AUG 05:20Z
    Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
    cvelistv5