CVE-2026-47875

Executive Summary

CVE-2026-47875 is a deserialization vulnerability affecting Broadcom's Spring Batch framework, specifically impacting versions 6.0.0–6.0.4 and 5.2.0–5.2.6. Applications using the Jackson2ExecutionContextStringSerializer to deserialize execution contexts with untrusted data sources for the job repository are vulnerable to arbitrary code execution via crafted malicious input. The vulnerability stems from an improper enforcement of the trusted-types allowlist in JobParameterDeserializer, which permits known Jackson RCE gadget chains to be triggered. With a CVSS score of 5.6 and an EPSS percentile of 16.0%, exploitation requires high attack complexity and depends on attackers having access to the job repository data source, though the impact can be severe (arbitrary code execution) for affected enterprise batch processing environments.

Technical Analysis

The vulnerability is rooted in Spring Batch's execution context serialization mechanism. Applications leveraging Jackson2ExecutionContextStringSerializer convert execution context objects to JSON for persistence in batch job repositories. When job state must be restored (e.g., for job restart, step retry, or status inspection), the serialized payload is deserialized back into Java objects.

The problem lies within JobParameterDeserializer, the component responsible for converting JSON data back into JobParameter objects. Spring Batch implements a trusted-types allowlist mechanism designed to prevent deserialization of arbitrary — and potentially malicious — Java classes. Under CVE-2026-47875, this allowlist is improperly enforced: the deserializer fails to restrict type resolution to a safe set of known-good classes, leaving the door open for polymorphic type deserialization. An attacker who can inject crafted JSON into the stored execution context can specify arbitrary Java class names that Jackson will instantiate during the deserialization process.

This flaw is significant because Jackson's default polymorphic deserialization behavior — even when using @JsonTypeInfo with an allowlist — has historically been susceptible to gadget-chain attacks. Known Jackson RCE gadgets (e.g., templates-impl-based chains such as those leveraging org.springframework.beans.factory.config.PropertyPathFactoryBean or other Spring-aware gadgets, or classic ones like com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl) can be embedded in JSON payloads. When deserialized, these gadgets trigger dangerous operations — commonly class loading followed by static initialization or method invocation — culminating in arbitrary code execution on the target JVM.

The trust boundary is critical: Spring Batch assumes the job repository is a trusted data source. When applications integrate external or shared data stores (databases, message-backed job repositories, or third-party scheduler integrations) as the job repository backend, the repository can no longer be implicitly trusted. If an attacker achieves write access to the job repository (via SQL injection elsewhere, misconfigured database permissions, or compromised CI/CD pipelines feeding job definitions), they can inject a malicious serialized execution context that will be deserialized when the job next runs or when job metadata is read.

The vulnerability class is CWE-502 (Deserialization of Untrusted Data). The CVSS vector indicates the attack vector is network-based (AV:N) though with high complexity (AC:H), requiring no privileges and no user interaction (PR:N/UI:N). The scope is unchanged (S:U) with low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). Notably, though arbitrary code execution is possible, the CVSS scoring suggests the difficulty of exploitation and possibly constrained impact in typical deployments. The EPSS score of 0.00248 (16% percentile) indicates low current exploit activity probability, and the CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.

Exploitation Scenarios

Based strictly on the NVD description, the following attack chain is inferred:

Step 1 — Reconnaissance and Target Identification: An attacker must first identify a Spring Batch deployment that (a) uses Jackson2ExecutionContextStringSerializer for execution context serialization, and (b) sources its job repository from a data store to which the attacker can write. This typically means a batch-processing platform exposed to broader network access — often internal enterprise environments with batch job orchestration, ETL pipelines, or data-processing applications. Public-facing targets are less common but possible (e.g., multi-tenant SaaS platforms allowing user-triggered batch jobs backed by shared infrastructure).

Step 2 — Triggering the Flaw: The attack requires injecting malicious serialized data into the job repository. Specific entry paths may include: SQL injection into the batch job metadata tables; compromised credentials for the job repository database; unauthorized access via exposed administrative batch-job interfaces; or write access through shared object stores (e.g., a cloud storage bucket misconfigured for public write that backs job context storage). Once write access is established, the attacker crafts a malicious JSON payload for an execution context that includes a polymorphic @class type specifier referencing a dangerous Java class consistent with known Jackson gadget chains.

Step 3 — Payload Execution: The malicious payload is deserialized during normal job operation — upon job restart, step retry, or job status retrieval from the persistent repository. Because the JobParameterDeserializer fails to enforce the allowlist, Jackson processes the embedded class type specifier and instantiates the attacker-controlled class. Standard Jackson gadget chains (e.g., using TemplatesImpl to compile and load bytecode embedded in the payload, or Spring-friendly chains executing bean property setters) are triggered during object deserialization, leading to arbitrary code execution in the context of the JVM running Spring Batch.

Step 4 — Post-Exploitation Impact: Successful exploitation yields code execution with the privileges of the Spring Batch application process. This typically allows lateral movement within data-center infrastructure: access to databases connected to the application, reading or modifying business data, potentially pivoting to adjacent services (message queues, configuration stores, cloud credentials). Because batch applications often have privileged access to production databases and file stores for batch processing, the blast radius extends well beyond the immediate application.

Note: The NVD description provides insufficient technical detail on the exact allowlist bypass method. No public PoC was available at the time of this report; the attack chain above is inferred from the vulnerability class and the description of the flaw.

Impact Assessment

The business impact of CVE-2026-47875 is moderate to high depending on deployment characteristics. The CVSS base score of 5.6 reflects high attack complexity and the pre-condition that an attacker already has write access to the job repository — a non-trivial prerequisite in properly segmented environments. That said, the consequences of successful exploitation are severe: arbitrary code execution (ACE) within the Spring Batch application. Batch processing systems frequently run with elevated database privileges and have access to sensitive enterprise data (payroll, inventory, financial records), making ACE particularly dangerous. For organizations where batch infrastructure is exposed to lower-trust zones or where job repositories are delegated to external services with uneven security controls, the real-world risk escalates.

Affected systems are those running Spring Batch 5.2.0–5.2.6 or 6.0.0–6.0.4 that (a) use Jackson2ExecutionContextStringSerializer (the default in many configurations), and (b) pull job state from a data source not fully trusted. The comprehensive scope (S:U) implies the compromise stays within the application's security domain; however, that domain often encompasses the full batch processing stack and its connected data stores.

Confidentiality, integrity, and availability impacts are each rated low in the CVSS vector, but this rating reflects a typical attack scenario with an assumed single compromised job context. In practice, an attacker with code execution on a batch server can achieve far broader lateral movement across the enterprise, unbounded by the nominal CVSS subscores.

Detection Guidance

Sigma Rule

title: Potential Spring Batch Deserialization Attempt via JobParameterDeserializer
id: 5f8b9324-3a4f-4def-93d2-c92a8d9f1c2a
status: experimental
description: Detects suspicious deserialization activity in logs related to Spring Batch execution context handling or JobParameter deserialization, potentially indicating CVE-2026-47875 exploitation attempts.
author: Threat Intelligence Team
date: 2026/05/15
logsource:
    category: application
    product: java
    definition: 'Requires application logging capturing exceptions from Spring Batch deserialization operations'
detection:
    selection_exception:
        - message|contains:
            - 'Jackson2ExecutionContextStringSerializer'
            - 'JobParameterDeserializer'
            - 'InvalidDefinitionException'
            - 'MismatchedInputException'
        - message|contains|all:
            - 'deserialize'
            - 'execution context'
    selection_priming:
        - message|contains|all:
            - 'class'
            - 'java.net.URLClassLoader'
            - 'TemplatesImpl'
            - 'org.springframework'
    condition: selection_exception or selection_priming
    timeframe: 15m
level: high
falsepositives:
    - Legitimate framework exceptions during batch job restarts
    - Development environments with verbose logging
fields:
    - src_ip
    - user
    - application
    - job_name
tags:
    - attack.t1203
    - attack.t1059
    - cve.2026.47875

YARA Rule

rule CVE_2026_47875_Spring_Batch_DeserializationIndicators
{
    meta:
        author = "ValtersIT Threat Intel Team"
        date = "2026-05-15"
        description = "Detects suspicious payload patterns associated with Jackson deserialization abuse against Spring Batch JobParameterDeserializer"
        reference = "CVE-2026-47875"
        cve = "CVE-2026-47875"
        severity = "high"
        tags = ["deserialization", "rce", "jackson", "spring-batch"]
    strings:
        $a = "@class" nocase
        $b = "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl" nocase
        $c = "org.springframework.beans.factory.config.PropertyPathFactoryBean" nocase
        $d = "java.net.URLClassLoader" nocase
        $e = "com.sun.rowset.JdbcRowSetImpl" nocase
        $f = "org.apache.commons.collections.functors.InvokerTransformer" nocase
        $g = "JobParameterDeserializer" nocase
        $h = "Jackson2ExecutionContextStringSerializer" nocase
        $i = "executionContext" nocase
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B20  // starts with JSON object/array
        and 1 of ($b, $c, $d, $e, $f)          // known Jackson gadget class names
        and ($a)                                // polymorphic type indicator
        and (1 of ($g, $h) or 1 of ($i))       // Spring Batch context reference
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-47875 - Spring Batch Deserialization Attempt (Jackson Gadget Class in Payload)"; flow:established,to_server; content:"JobParameterDeserializer"; nocase; http.method; content:"@class"; http.request_body; content:"TemplatesImpl"; distance:0; within:200; http.request_body; content:"Jackson2ExecutionContextStringSerializer"; within:500; side:both; reference:cve,2026-47875; sid:200007003; rev:1;)

Detection logic note: This rule inspects HTTP request bodies for polymorphic type markers combined with known Jackson gadget class names alongside Spring Batch serializer references. Due to the high complexity of payload fragmentation, organizations should pair this with application-level logging on deserialization exceptions.

Elastic Detection

// EQL rule to detect Spring Batch deserialization anomalies at the application-log level
sequence by host.ip, process.executable
  [any where true] // placeholder for process start context
  [file where event.action == "write" and file.extension == "log" and process.name : "java*"]
  // Capture deserialization exceptions in application logs
  [timeout 5m
    any where
      (message : "*InvalidDefinitionException*" or
       message : "*MismatchedInputException*" or
       message : "*JsonMappingException*")
    and (message : "*Jackson2ExecutionContextStringSerializer*" or
         message : "*JobParameterDeserializer*")]
  [timeout 1m
    any where (message : "*TemplatesImpl*" or
               message : "*PropertyPathFactoryBean*" or
               message : "*URLClassLoader*")  // gadget class indicators
  ]

Splunk SPL Query

index=windows
  OR index=xmlwineventlog
  OR index=linux_main
  sourcetype="ossec_alerts"
  OR sourcetype="json_java"
  OR sourcetype="spring_batch"
  | search ("Jackson2ExecutionContextStringSerializer" OR "JobParameterDeserializer") 
  | search ("InvalidDefinitionException" OR "MismatchedInputException" OR "UnrecognizedPropertyException" OR "JsonMappingException")
  | rex field=_raw "(?<job_name>\w*Batch\w*)"
  | eval severity=case(
        _raw LIKE "%TemplatesImpl%" OR _raw LIKE "%PropertyPathFactoryBean%" OR _raw LIKE "%URLClassLoader%" , "critical",
        true(), "high")
  | fillnull value="unknown" job_name
  | stats count min(_time) as first_seen max(_time) as last_seen by host, source, severity, job_name, message
  | where count >= 1
  | convert ctime(first_seen), ctime(last_seen)
  | sort + last_seen

Index guidance: Adjust the index names to match enterprise log-management infrastructure. Consider additional sources such as WebSphere logs, Tomcat catalina.out, and application-specific batch-logging channels where Spring Batch subsystems write operational logs.

Wazuh OSSEC Rule

<group name="springbatch,rce,deserialization,">
  <!-- Detects Jackson deserialization exceptions corresponding to CVE-2026-47875 -->
  <rule id="594855" level="10">
    <if_sid>515</if_sid>
    <match>Jackson2ExecutionContextStringSerializer|JobParameterDeserializer</match>
    <description>Spring Batch: Potential deserialization vulnerability exploit attempt (CVE-2026-47875)</description>
    <group>springbatch,deserialization,rce,</group>
    <mitre>
      <tactic>T1203</tactic>
    </mitre>
    <options>no_full_log</options>
    <field name="cve">2026-47875</field>
  </rule>

  <!-- Higher-level rule: indicates likely RCE gadget present -->
  <rule id="594856" level="12">
    <if_sid>50275</if_sid>
    <match>TemplatesImpl|PropertyPathFactoryBean|URLClassLoader</match>
    <description>Spring Batch: Deserialization RCE gadget class detected in logs (CVE-2026-47875)</description>
    <group>springbatch,deserialization,rce,gadget,</group>
    <mitre>
      <tactic>T1203</tactic>
    </mitre>
    <field name="cve">2026-47875</field>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — NVD lists a single source claiming a patch is available, though it is not independently confirmed and no vendor advisory was accessible at publication time.

Immediate Mitigations:

1. Trust the job repository only if absolutely necessary. Re-architect deployments so the job repository is exclusively an internal, isolated datastore inaccessible to external or lower-trust systems. Enforce strict network segmentation between the job repository's backend database/storage and any untrusted network segments.
2. Monitor for unauthorized writes to the job repository. Deploy database activity monitoring or storage-audit logging on the tables/buckets holding serialized execution contexts. Anomalous inserts or updates to job execution context rows should generate alerts.
3. Examine existing batch job repositories for existing payloads. Audit stored execution contexts and job parameter blobs for JSON containing @class markers with unusual or dangerous class references; review job definitions and metadata tables for anomalies.
4. Evaluate exposure. Inventory all Spring Batch deployments running versions 5.2.0–5.2.6 or 6.0.0–6.0.4. Prioritize those whose batch repositories are on shared multi-tenant databases, cloud object stores, or where write access is not tightly scoped.

Patch/Upgrade Steps:

1. Upgrade Spring Batch to fixed versions once confirmed: likely 6.0.5+ for the 6.0.x line and 5.2.7+ for 5.2.x. Monitor the official Spring Batch / Broadcom advisory channels for the exact patched release.
2. Validate patch availability through NVD against the vendor's official release notes. Until independently confirmed, treat the patch as provisional and rely on mitigations above in parallel.
3. After upgrade, verify that execution context deserialization rejects unknown type identifiers and re-run security regression tests against your batch pipelines.

Long-Term Hardening:

1. Adopt a defense-in-depth approach to Spring Batch security: avoid serializing full execution contexts into external stores when only lightweight metadata is needed; consider storing only job identifiers and reconstructing context state from application-side managed state.
2. Harden the job repository data source: apply least-privilege database credentials to Spring Batch and its connected job repository; restrict writes to known application service accounts; enable database firewalls or row-level security.
3. Enable global Jackson deserialization hardening: configure ObjectMapper globally to reject unknown polymorphic types, disable default typing when not absolutely required, and maintain an explicit allowlist for any custom types in addition to the framework-level trusted-types check.
4. Integrate runtime indicators into existing monitoring pipelines: use the Sigma/Suricata/EQL/SPL/Wazuh rules above to detect anomalies. Complement with periodic scanning of stored job context payloads for gadget-class identifiers.
5. Maintain awareness of CISA KEV: if CVE-2026-47875 is added to KEV in the future, treat exploitation as active and escalate organizational response accordingly.
6. Consider network-level safeguards for batch orchestration services: apply egress filtering from batch app servers, restrict outbound network calls, and ensure the JVM executes with the least privilege possible for the application function.

References

1. NVD Entry for CVE-2026-47875: https://nvd.nist.gov/vuln/detail/CVE-2026-47875
2. MITRE CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
3. Spring Batch official documentation on execution context serialization (referenced for architecture context): https://docs.spring.io/spring-batch/reference/
4. Broadcom/Spring Security Advisories (patch claim source): https://security.broadcom.com/ — monitor for CVE-2026-47875 bulletin
5. CISA Known Exploited Vulnerabilities Catalog (no listing at report time): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / in-the-wild exploitation: No in-the-wild exploitation or threat-actor campaigns were publicly documented as of the report date. EPSS score of 0.00248 corroborates low current exploitation likelihood. The CVE is not listed on the CISA KEV catalog. However, given the high value of batch-processing targets in enterprise networks, combine the presence of public PoC availability with the high complexity requirement (AC:H) and assume attacker interest is likely to grow once working PoCs circulate in the research and criminal communities.