Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an
    "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring
    Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework
    6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
    (CVE-2026-47884)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an     /** mapping that results in view rendering, and where the view name is not explicitly specified. Spring     Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework     6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier     (CVE-2026-47884)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473057	Echo: org.springframework:spring-webmvc: security update to 7.0.9	Tenable Cloud Security	Echo Local Security Checks	Local	critical
473057	Echo: org.springframework:spring-webmvc: security update to 7.0.9	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
473000	SCA: security update for org.springframework:spring-webmvc (GHSA-pc63-qcmh-9cmg)	Tenable Cloud Security	SCA Checks	Local	critical
473000	SCA: security update for org.springframework:spring-webmvc (GHSA-pc63-qcmh-9cmg)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
341785	Linux Distros Unpatched Vulnerability : CVE-2026-47884	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-47884

critical

Tenable Plugins

critical

critical

critical

critical

critical