CVE-2026-59293
MediumCVSS 6.6Summary
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Affects Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.
Risk Assessment
An attacker can intercept and modify transmitted data, potentially leading to credential theft or compromise of file integrity. This may result in unauthorized access to systems.
Recommendation
It is recommended to upgrade Spring Integration to a patched version. Also explicitly set smbMinVersion to a secure SMB protocol version.
Original NVD description (English source)
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12