CVE-2026-59293: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') in Spring Spring Integration

The vulnerability arises from the default behavior of the jCIFS client used in Spring Integration, which negotiates SMB protocol versions. Without explicitly raising the smbMinVersion parameter, the client may fall back to SMB1/CIFS, a protocol known to lack mandatory signing and encryption. This downgrade to a less secure algorithm (CWE-757) can expose communications to NTLM relay attacks and content tampering man-in-the-middle attacks. The affected versions are Spring Integration 6.4.0 to 6.4.12, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5, and 7.1.0. The CVSS v3.1 score is 6.6, reflecting network attack vector, high privileges required, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

If exploited, this vulnerability could allow an attacker to perform NTLM relay and content tampering man-in-the-middle attacks by forcing the SMB negotiation to downgrade to SMB1, which lacks mandatory signing and encryption. This compromises the confidentiality, integrity, and availability of communications using the affected Spring Integration versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, applications should explicitly configure the smbMinVersion parameter to a higher SMB protocol version to prevent negotiation down to SMB1 and mitigate the risk of downgrade attacks.