Executive brief
Spring Integration, a framework used to integrate enterprise applications, uses the jCIFS client for SMB file sharing. By default, the jCIFS client can negotiate down to outdated SMB1/CIFS protocol, which lacks mandatory encryption and signing protections. An attacker positioned on the network can intercept and modify file contents or relay authentication credentials in transit, potentially compromising data integrity and enabling account takeover.
Technical details
The vulnerability is a protocol downgrade issue in the jCIFS CIFS client library bundled with Spring Integration. Unless the application explicitly sets smbMinVersion, the client will negotiate down to SMB1/CIFS, which lacks mandatory message signing and encryption. This allows an attacker on the network (adjacent network access) to perform NTLM relay attacks and man-in-the-middle content tampering. The vulnerability affects Spring Integration versions 6.4.0–6.4.12, 6.5.0–6.5.10, and 7.0.0–7.0.5; version 7.1.0 and later default to a higher minimum SMB version. Mitigation requires upgrading to a patched version or explicitly configuring smbMinVersion in the application.
Affected products
- Pivotal Spring Integration 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5
Timeline
- 2026-08-27: disclosed