How severe is CVE-2026-47850?

CVE-2026-47850 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2026-47850 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-47850?

CVE-2026-47850 affects Vmware Spring Data Rest. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-47850?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-47850 published?

CVE-2026-47850 was published on 2026-08-27 and last updated on 2026-09-04.

CVE-2026-47850

CVE-2026-47850 is a medium-severity vulnerability in Vmware Spring Data Rest with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-915.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-915
Affected product: Vmware Spring Data Rest
Published: 2026-08-27
Last modified: 2026-09-04

Description

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

Frequently asked questions

What is CVE-2026-47850?: Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier
How severe is CVE-2026-47850?: CVE-2026-47850 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-47850 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-47850?: CVE-2026-47850 affects Vmware Spring Data Rest. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-47850?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-47850 published?: CVE-2026-47850 was published on 2026-08-27 and last updated on 2026-09-04.

References

https://spring.io/security/cve-2026-47850

Affected products (1)

cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*

More vulnerabilities in Vmware Spring Data Rest

CVE-2018-1273 — Critical (CVSS 9.8): Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a…
CVE-2017-8046 — Critical (CVSS 9.8): Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions…
CVE-2026-41729 — High (CVSS 8.1): Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch…
CVE-2026-41728 — High (CVSS 7.5): Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to…
CVE-2018-1259 — High (CVSS 7.5): Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or…
CVE-2018-1274 — High (CVSS 7.5): Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path…

All CVEs affecting Vmware Spring Data Rest →

Other CWE-915 vulnerabilities

CVE-2026-50160 — Critical (CVSS 10.0): Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and…
CVE-2026-33453 — Critical (CVSS 10.0): Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap…
CVE-2025-58367 — Critical (CVSS 10.0): DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are…
CVE-2026-56142 — Critical (CVSS 9.9): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2026-72710 — Critical (CVSS 9.8): SPIP before 4.4.18 contains a mass assignment vulnerability in the editer_objet action that allows unauthenticated…
CVE-2026-12535 — Critical (CVSS 9.8): Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field…

Browse all CWE-915 vulnerabilities →