External risk intelligence

Spring MVC SSRF and RCE Vulnerability with XsltView

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47884

This vulnerability affects Spring MVC, a framework commonly used to build internet-facing web applications and public-facing APIs. Applications utilizing this framework often expose controllers directly to the internet, making them typical targets for web-based attack vectors like those described.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Spring MVC framework, a widely-used technology for building web applications and APIs. This issue could allow unauthorized access to applications and potentially lead to compromise if specific configurations are present. The primary concern is to confirm if our applications utilize this technology and are exposed to this particular threat.

Attackers can exploit certain Spring MVC setups.
Affects common web applications and APIs.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to a Spring MVC application. If the application uses `XsltView` without explicitly defining the view name and has a catch-all mapping like `/**`, the attacker can manipulate the application to render a malicious view. This could allow the attacker to achieve server-side request forgery or even remote code execution.

No authentication or user interaction required.
Triggered by un-sanitized view name input.
Leads to server-side request forgery or code execution.

Live Threat

Current exploitation, exposure, and threat context

When an application using Spring MVC has an `/**` mapping that allows view rendering without an explicitly specified view name, an attacker could potentially trigger Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE). This could impact the confidentiality, integrity, and availability of the affected application and its underlying system.

Application view rendering logic.
Unvalidated user input determines view.
System compromise and data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Spring MVC's XsltView could allow attackers to execute arbitrary code or perform server-side requests if view rendering is enabled for unmapped paths and view names are not explicitly set. The first practical step is to identify all instances of the affected Spring Framework versions, assess their exposure and business criticality, determine the accountable owner, and then prioritize remediation.

Application owners should lead remediation efforts.
Verify SSRF/RCE exposure and business criticality.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Spring Framework?

Spring Framework is a foundational Java platform used by developers to build robust, scalable web applications and microservices. It simplifies complex enterprise programming tasks by providing a structure for managing application components and handling web requests via its MVC module. It is a industry-standard technology for creating both internal business tools and public-facing web portals.

How does CVE-2026-47884 affect application security?

This vulnerability is classified as CWE-22, which involves improper limitation of a pathname to a restricted directory. In this context, it allows an attacker to influence how the XsltView component renders pages. Because the application logic does not properly isolate the view name, it can be manipulated to perform unauthorized actions like Server-Side Request Forgery or, in severe cases, execute arbitrary commands on the server.

When is an application vulnerable to this flaw?

An application is only at risk if it uses specific configurations: it must use XsltView to render pages, allow a catch-all '/**' mapping that triggers rendering, and fail to explicitly define the view name. If your application logic explicitly maps or validates all view names before rendering, or does not use XsltView at all, these specific attack conditions are not met.

Is my application at high risk?

According to Halo Surface Signal, this risk is higher for internet-facing applications because they are directly reachable by unauthorized external actors. Since Spring MVC is frequently used to host public APIs and web portals, the lack of required authentication to trigger this bug makes internet-accessible instances primary targets for investigation.

How should I begin addressing this vulnerability?

Start by auditing your software inventory to locate all applications running the affected versions of the Spring Framework. Once identified, work with the application owners to determine if the specific XsltView configuration is in use. Prioritize patching or configuration changes for systems that are internet-facing or handle sensitive data to mitigate the potential for remote exploitation.

References

spring.io/security/cve-2026-47884

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.