ZeroDay Findings
Sign inSign up

Findings

CVE-2022-22965

Spring Framework JDK 9+ Remote Code Execution Vulnerability

Published Apr 1, 2022 · updated Jun 16, 2026 · vmware spring framework

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 1, 2022 · Catalog

    Detected

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there m

  2. Apr 4, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 25, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there m

Required action

Apply updates per vendor instructions.

CISA due date Apr 25, 2022

Affected

  • cpe cisco/cx cloud agentversion unspecified
  • cpe oracle/commerce platform11.3.2
  • cpe oracle/communications cloud native core automated test suite1.9.0
  • cpe oracle/communications cloud native core automated test suite22.1.0
  • cpe oracle/communications cloud native core console1.9.0
  • cpe oracle/communications cloud native core console22.1.0
  • cpe oracle/communications cloud native core network exposure function22.1.0
  • cpe siemens/operation schedulerversion unspecified
  • cpe veritas/access appliance7.4.3
  • cpe vmware/spring frameworkversion unspecified
  • vendor VMware Spring Frameworkversion unspecified

Sources

  • CISA KEVCVE-2022-22965

    Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    cisa.gov
  • CVE.orgCVE-2022-22965

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-22965

    30-day exploitation probability 99.6%

    first.org
  • Metasploit Modulesexploit_multi/http/spring_framework_rce_spring4shell

    Public module reference (manual). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2022-22965

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References