CVE-2026-59293

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0

Description The jCIFS client may negotiate down to SMB1/CIFS if the application does not explicitly raise the smbMinVersion variable. SMB1/CIFS lacks mandatory signing and encryption, making the connection susceptible to NTLM relay attacks and content-tampering Man-in-the-Middle (MITM) attacks, where an attacker intercepts and modifies communication between two parties.

Recommendations Explicitly raise the smbMinVersion variable to prevent the client from negotiating down to SMB1/CIFS.