Description
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Published: 2026-08-27
Score: 6.6 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The jCIFS client used by Spring Integration negotiates the SMB1 protocol dialect unless the application explicitly raises the minimum SMB version. SMB1 lacks mandatory signing and encryption, making the connection vulnerable to NTLM relay attacks and content‑tampering by a man‑in‑the‑middle. This weakness can be exploited to intercept or modify data sent over the SMB session, potentially compromising confidentiality and integrity of file transfers or other SMB operations.

Affected Systems

Spring Integration versions 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12 are affected by this protocol‑downgrade issue.

Risk and Exploitability

The CVSS score is 6.6, indicating a moderate risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to an SMB endpoint and the ability to negotiate protocol versions; by default the client off‑loads to SMB1, enabling MITM and NTLM relay attacks without requiring special privileges.

Generated by OpenCVE AI on August 28, 2026 at 06:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Spring Integration release that patches the SMB protocol negotiation bug.
  • Configure the jCIFS client to set a minimum SMB version of SMB2 or higher by raising the smbMinVersion property, preventing negotiation of SMB1.
  • Block or disable SMB1 traffic on the network using firewall or security group rules to eliminate the downgrade pathway.

Generated by OpenCVE AI on August 28, 2026 at 06:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-59293 cve-icon cve-icon
History

Fri, 28 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-326
CWE-327

Fri, 28 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Spring
Spring spring Integration
Vendors & Products Spring
Spring spring Integration

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Title SMB minimum protocol dialect defaults to SMB1
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Spring Spring Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-27T17:57:51.016Z

Reserved: 2026-07-04T18:13:34.323Z

Link: CVE-2026-59293

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-27T20:17:55.460

Modified: 2026-08-27T20:17:55.460

Link: CVE-2026-59293

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T07:00:12Z

Weaknesses
  • CWE-326

    Inadequate Encryption Strength

  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm