CVE-2022-22947VulnerabilityPublished 05/16/2022Updated 10/24/2026

CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability

Affects VMware Spring Cloud GatewaySource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/16/2022
KEV deadline: 06/06/2022
EPSS: 98.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-22947 (opens in a new tab)

Description

Spring Cloud Gateway applications with the Gateway Actuator endpoint enabled, exposed, and unsecured are vulnerable to a code injection attack. This vulnerability allows attackers to execute arbitrary code remotely. It has been exploited in the wild and is considered a high severity threat.

Summary

CVE-2022-22947 is a code injection vulnerability affecting Spring Cloud Gateway applications when the Gateway Actuator endpoint is enabled, exposed, and not properly secured. This flaw allows an attacker to inject and execute arbitrary code remotely, potentially compromising the affected system. The vulnerability has been actively exploited in the wild, highlighting its critical nature. No specific affected versions or patch information is provided in the available data.

Impact

Successful exploitation of this vulnerability can lead to remote code execution on the affected Spring Cloud Gateway application, potentially allowing attackers to take control of the system, access sensitive data, or disrupt services. The vulnerability has been confirmed as exploited in the wild, indicating active threat and real-world impact.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the Gateway Actuator endpoint is not exposed or is properly secured with authentication and network controls to prevent unauthorized access.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:40:39 UTC

Weaknesses

References

Related threats