CVE-2016-1000027

Name: CVE-2016-1000027
Creator: NVD / NIST
Published: 2020-01-02T23:15:11.857+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 32.26%

Last modified Jun 17, 2026

CVE-2016-1000027 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. EPSS estimates a 32.26% chance of exploitation in the next 30 days.

Description

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

32.26%

98.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-502

Affected Software

Vendor	Product	Versions
Vmware	Spring Framework	< 6.0.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027Issue Tracking, Third Party Advisory
https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626Issue Tracking, Third Party Advisory
https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417Issue Tracking, Third Party Advisory
https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525Issue Tracking, Third Party Advisory
https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.jsonBroken Link, Exploit, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2016-1000027Third Party Advisory
https://security.netapp.com/advisory/ntap-20230420-0009/
https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-nowRelease Notes, Third Party Advisory
https://www.tenable.com/security/research/tra-2016-20Exploit, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027Issue Tracking, Third Party Advisory
https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626Issue Tracking, Third Party Advisory
https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417Issue Tracking, Third Party Advisory
https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525Issue Tracking, Third Party Advisory
https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.jsonBroken Link, Exploit, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2016-1000027Third Party Advisory
https://security.netapp.com/advisory/ntap-20230420-0009/
https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-nowRelease Notes, Third Party Advisory
https://www.tenable.com/security/research/tra-2016-20Exploit, Third Party Advisory

Timeline

Published: Jan 2, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-1000027?

How severe is CVE-2016-1000027?

CVE-2016-1000027 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 32.26% probability of exploitation in the next 30 days.

How do I fix CVE-2016-1000027?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-1000027?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST