# Spring vulnerabilities & exploitation

> As of 2026-10-27, Threadlinqs tracks 10 Spring CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 1 tracked threat campaign.

**Data as of:** 2026-10-27

## Exploitation timeline

Threadlinqs has recorded 10 Spring CVEs published between 2026-06-15 and 2026-08-15. The busiest month was 2026-08 (9 new CVEs). None of them is listed in CISA KEV yet.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 10 of 10 tracked Spring CVEs.

- [CVE-2026-41699](https://intel.threadlinqs.com/cve/CVE-2026-41699) — HIGH 8.1 · EPSS 0.7% · 2026-06-11
- [CVE-2026-59279](https://intel.threadlinqs.com/cve/CVE-2026-59279) — HIGH 7.5 · EPSS 0.5% · 2026-08-21
- [CVE-2026-47851](https://intel.threadlinqs.com/cve/CVE-2026-47851) — HIGH 7.5 · EPSS 0.5% · 2026-08-26
- [CVE-2026-59285](https://intel.threadlinqs.com/cve/CVE-2026-59285) — HIGH 8.1 · EPSS 0.4% · 2026-08-27
- [CVE-2026-59294](https://intel.threadlinqs.com/cve/CVE-2026-59294) — MEDIUM 5.9 · EPSS 0.4% · 2026-08-27
- [CVE-2026-47852](https://intel.threadlinqs.com/cve/CVE-2026-47852) — HIGH 7.5 · EPSS 0.3% · 2026-08-26
- [CVE-2026-59319](https://intel.threadlinqs.com/cve/CVE-2026-59319) — MEDIUM 4.3 · EPSS 0.3% · 2026-08-27
- [CVE-2026-59318](https://intel.threadlinqs.com/cve/CVE-2026-59318) — MEDIUM 6.5 · EPSS 0.3% · 2026-08-21
- [CVE-2026-59308](https://intel.threadlinqs.com/cve/CVE-2026-59308) — MEDIUM 4.2 · EPSS 0.2% · 2026-08-21
- [CVE-2026-41707](https://intel.threadlinqs.com/cve/CVE-2026-41707) — HIGH 7.4 · 2026-08-25

## Products affected

Threadlinqs normalises CPE and CNA product records across all 10 CVEs; 3 distinct Spring products are affected. The most frequently affected:

- AI — 7 CVEs
- for GraphQL — 2 CVEs
- Security — 1 CVE

## Threat activity

1 tracked threat campaign reference Spring products or exploit Spring CVEs:

- [91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285](https://intel.threadlinqs.com/threat/TL-2026-2105) — CRITICAL — 2026-08-21

## How to prioritise Spring patching

This order follows the data Threadlinqs holds for Spring, not a generic severity checklist:

- No Spring CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are [CVE-2026-41699](https://intel.threadlinqs.com/cve/CVE-2026-41699) (0.7%), [CVE-2026-59279](https://intel.threadlinqs.com/cve/CVE-2026-59279) (0.5%), [CVE-2026-47851](https://intel.threadlinqs.com/cve/CVE-2026-47851) (0.5%).
- 0 CVEs score Critical and 6 High on CVSS v3 (maximum 8.1, average 6.7); sequence these after KEV and high-EPSS items.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-27 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/spring
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp