Quick answers
- Is CVE-2026-59292 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59292 being exploited in the wild.
- How severe is CVE-2026-59292?
- Low severity, with a CVSS score of 3.2, published 27 August 2026.
- Which products and versions are affected?
- VMware Spring Integration 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5.
- Is there a fix for CVE-2026-59292?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-59292 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-59292?
- Check whether you run VMware Spring Integration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The PropertiesPersistingMetadataStore class, which is the default file-based ConcurrentMetadataStore implementation in Spring Integration, persists application state to a properties file at ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. This is a local information disclosure vulnerability accessible only to users on the same system with read access to the temporary directory. The vulnerability affects Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5; version 7.1.0 and later have fixed the issue by restricting file permissions.
Affected products
- VMware Spring Integration 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5
Timeline
- 2026-08-27: disclosed