CVE-2026-47873
CVE-2026-47873 is a high-severity vulnerability in Broadcom Spring Tools with a CVSS 3.x base score of 8.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1327.
Key facts
- Severity: High (CVSS 3.x base score 8.0)
- EPSS exploit prediction: 0% (19th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1327
- Affected product: Broadcom Spring Tools
- Published:
- Last modified:
Description
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Frequently asked questions
- What is CVE-2026-47873?
- The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
- How severe is CVE-2026-47873?
- CVE-2026-47873 has a CVSS 3.x base score of 8.0, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2026-47873 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-47873?
- CVE-2026-47873 affects Broadcom Spring Tools. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-47873?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-47873 published?
- CVE-2026-47873 was published on 2026-07-30 and last updated on 2026-09-30.
References
Affected products (1)
- cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:eclipse:*:*
More vulnerabilities in Broadcom Spring Tools
- CVE-2026-47882 — High (CVSS 8.3): When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud…
- CVE-2026-47858 — High (CVSS 8.0): Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running…
- CVE-2026-59327 — Medium (CVSS 4.4): Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain…
- CVE-2026-59328 — Medium (CVSS 4.2): Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT…
- CVE-2026-59326 — Low (CVSS 3.3): The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment…
All CVEs affecting Broadcom Spring Tools →
Other CWE-1327 vulnerabilities
- CVE-2026-82456 — Critical (CVSS 10.0): argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller…
- CVE-2025-61934 — Critical (CVSS 10.0): A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19.…
- CVE-2023-1968 — Critical (CVSS 10.0): Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An…
- CVE-2026-20212 — Critical (CVSS 9.8): A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated,…
- CVE-2026-24015 — Critical (CVSS 9.8): A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before…
- CVE-2026-0481 — Critical (CVSS 9.2): Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to…