SMB minimum protocol dialect defaults to SMB1

MEDIUM | AUGUST 20, 2026 | CVE-2026-59293

Description

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. An on-path attacker can downgrade the dialect, intercept or alter files moved by the SMB adapters, or capture NTLM credentials.

Affected Spring Products and Versions

Spring Integration:

  • 7.1.0 - 7.1.0
  • 7.0.0 - 7.0.5
  • 6.5.0 - 6.5.10
  • 6.4.0 - 6.4.12

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
7.1.0.1Enterprise Support Only
7.1.1OSS
7.0.5.1Enterprise Support Only
7.0.6OSS
6.5.11Enterprise Support Only
6.4.13Enterprise Support Only

No further mitigation steps are necessary.

History

  • 2026-08-20: Initial vulnerability report published.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all