Skip to content
Fencer Vulns
critical 9.8

CVE-2022-22965 kev in the critical feed json

Remote Code Execution in Spring Framework

published 2022-03-31 4 y ago modified 2026-06-17 4 mo ago also GHSA-36p3-wjmg-h94x , EUVD-2022-1283

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2022-04-04
epss
99.6%
EPSS 99.6% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit, plus a Nuclei check

Summary

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • maven org.springframework:spring-beans 5.2.20.RELEASE, 5.3.18
  • maven org.springframework:spring-webmvc 5.2.20.RELEASE, 5.3.18
  • maven org.springframework.boot:spring-boot-starter-web 2.5.12, 2.6.6
  • maven org.springframework:spring-webflux 5.2.20.RELEASE, 5.3.18
  • maven org.springframework.boot:spring-boot-starter-webflux 2.5.12, 2.6.6
  • vmware spring_framework 5.2.20, 5.3.18
  • cisco cx_cloud_agent 2.1.0
  • oracle mysql_enterprise_monitor 8.0.29
  • siemens operation_scheduler 2.0.4
  • siemens simatic_speech_assistant_for_machines 1.2.1
  • siemens sinec_network_management_system 1.0.3
  • libspring-java Ubuntu 25.10 4.3.30-2ubuntu1
  • libspring-java Ubuntu Pro 18.04 LTS 4.3.22-1~18.04.1~esm1
  • libspring-java Ubuntu Pro 20.04 LTS 4.3.22-4ubuntu0.1~esm1
  • libspring-java Ubuntu Pro 22.04 LTS 4.3.30-1ubuntu0.1~esm1
  • libspring-java Ubuntu Pro 24.04 LTS 4.3.30-2ubuntu0.24.04.1~esm1

ubuntu advisories UBUNTU-CVE-2022-22965

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-22965 updated cvss 8.1

spring-framework: RCE via Data Binding on JDK 9+

  • Red Hat Integration Camel Quarkus 1 spring-beans
    affected: workaround, no fix available
  • Red Hat JBoss A-MQ 6 spring-webmvc Red Hat JBoss Fuse 6 spring-webmvc Red Hat Virtualization 4 rhvm-dependencies
    affected: workaround, no fix available “Fix deferred”
  • Red Hat CEQ 2.2.1-1 (CVE-2022-22965)
    fixed: vendor fix RHSA-2022:1306
  • Red Hat AMQ 7.8.6
    fixed: vendor fix RHSA-2022:1626
  • Red Hat AMQ 7.9.4
    fixed: vendor fix RHSA-2022:1627
  • Red Hat Fuse 7.10.2
    fixed: vendor fix RHSA-2022:1360
  • Red Hat RHDM 7.12.1 async
    fixed: vendor fix RHSA-2022:1379
  • Red Hat RHINT Camel-K 1.6.5
    fixed: vendor fix RHSA-2022:1333
show 1 more

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-286-05 updated cvss 7.5

Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

  • Hitachi Energy Lumada Asset Performance Manager (APM) <= 6.3.220323.0, >= 6.0.0.0, <= 6.0.0.4, 6.1.0.0, 6.1.0.1, >= 6.2.0.0, <= 6.2.0.2
    affected: mitigation “Hitachi Energy recommends applying the most recent patch version of Lumada Asset Performance Management (APM) or upgrading to a newer, unaffected major version:” hitachienergy.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/spring_framework_rce_spring4shell)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-04-25 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
VMware, Spring Framework
CISA name
Spring Framework JDK 9+ Remote Code Execution Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1190 Exploit Public-Facing Application exploitation
  • T1059 Command and Scripting Interpreter primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

99.64% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

ecosystem package affected fixed in
maven org.springframework:spring-beans
<5.2.20.RELEASE
>=5.3.0, <5.3.18
5.2.20.RELEASE
5.3.18
maven org.springframework:spring-webmvc
<5.2.20.RELEASE
>=5.3.0, <5.3.18
5.2.20.RELEASE
5.3.18
maven org.springframework.boot:spring-boot-starter-web
<2.5.12
>=2.6.0, <2.6.6
2.5.12
2.6.6
maven org.springframework:spring-webflux
<5.2.20.RELEASE
>=5.3.0, <5.3.18
5.2.20.RELEASE
5.3.18
maven org.springframework.boot:spring-boot-starter-webflux
<2.5.12
>=2.6.0, <2.6.6
2.5.12
2.6.6

Affected products

  • n/a Spring Framework

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.