Critical Vulnerabilities in Spring Tools IDE Extensions

VMware has released a security advisory (AV26-759) detailing six vulnerabilities affecting Spring Tools for Eclipse (versions <= 5.2.0) and Spring Tools for VSCode, Cursor, and Theia (versions <= 2.2.0). The vulnerabilities range from critical Remote Code Execution (RCE) flaws to information disclosure and Cross-Site Scripting (XSS).

The most severe issue, CVE-2026-47858, allows for RCE via live information startup mode. Additionally, CVE-2026-47873 exposes JDWP and JMX ports on all network interfaces, providing a pathway for unauthenticated remote access to debugging and management interfaces. Other identified issues include the use of a non-cryptographic PRNG for DevTools remote secrets (CVE-2026-47882), plaintext logging of HTTP proxy credentials (CVE-2026-59326), insecure local storage of secrets in Eclipse launch configurations (CVE-2026-59327), and XSS in dependency tooltips (CVE-2026-59328). Organizations using these developer tools should prioritize updating to the latest versions to mitigate these risks.

Impact

Successful exploitation of these vulnerabilities could result in full system compromise, unauthorized access to developer environments, theft of sensitive credentials (proxy and remote secrets), and potential for lateral movement within a development network. These flaws directly impact the integrity and confidentiality of developer workstations and the software build pipelines they support.

Recommendation

• Update Spring Tools for Eclipse to the latest version immediately to remediate CVE-2026-47858, CVE-2026-47873, CVE-2026-47882, CVE-2026-59326, CVE-2026-59327, and CVE-2026-59328.
• Update Spring Tools for VSCode, Cursor, and Theia to the latest version to address these vulnerabilities.
• Audit developer workstations for insecure IDE configurations, particularly regarding exposed JDWP/JMX ports.
• Rotate any credentials that may have been logged in plaintext or stored insecurely due to CVE-2026-59326 and CVE-2026-59327.