Quick answers
- Is CVE-2026-59307 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59307 being exploited in the wild.
- How severe is CVE-2026-59307?
- High severity, with a CVSS score of 8, published 27 August 2026.
- Which products and versions are affected?
- Spring Integration 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, 7.1.0.
- Is there a fix for CVE-2026-59307?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-59307 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-59307?
- Check whether you run Spring Integration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a deserialization restriction bypass in Spring Integration's JdbcMessageStore component. When an operator calls addAllowedPatterns(...) to whitelist safe classes for deserialization, the restrictions are not applied if the store is managed as a Spring bean rather than instantiated directly. An attacker who can control serialized objects stored in or flowing through the message store (typically requiring network access or the ability to inject messages) can craft malicious payloads that exploit Java deserialization to achieve remote code execution. The issue stems from the allowed patterns not being properly enforced in the Spring-managed context. Patches are available in Spring Integration 6.4.13, 6.5.11, and 7.0.6 or later.
Affected products
- Spring Integration 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, 7.1.0
Timeline
- 2026-08-27: disclosed