{"id":"CVE-2022-22965","published":"2022-04-01T23:15:13Z","modified":"2026-06-17T04:29:15Z","title":"Spring Framework JDK 9+ Remote Code Execution Vulnerability","vendor":"VMware","product":"Spring Framework","tier":"core","eol":null,"description":{"text":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","provenance":"source","from":"NVD"},"summary":{"text":"Spring Framework's data binding in Spring MVC and Spring WebFlux applications running on JDK 9+ contains a flaw that can lead to remote code execution. The flaw is in how these applications handle data binding, and it is specifically exposed when the application is deployed as a WAR on Tomcat, while Spring Boot executable jars are not affected by the specific exploit described. An attacker with network access and no authentication or user interaction could send crafted requests to a vulnerable WAR-deployed application to execute code on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:17Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99638,"percentile":0.9995,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-04-04","dueDate":"2022-04-25","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-04-04","exploitedFirstSeen":"2022-04-04","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-04"},{"url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","date":"2022-04-08"},{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"},{"url":"https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities","date":"2022-12-06"},{"url":"https://blog.netlab.360.com/new-ddos-botnet-wszeor/","date":"2022-12-07"},{"url":"https://t.me/hacking_Attack/79492","date":"2022-12-08"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":"2022-12-21"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation","date":"2022-12-22"},{"url":"https://www.prio-n.com/a-year-in-review-2022-100-vulnerabilities-you-should-prioritize/","date":"2023-02-02"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/unit42-cloud-threat-report-volume7.pdf","date":"2023-04-18"}],"evidenceTotal":860,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"TSEC Honeypot: Exploit Attempt - Week of 2026-10-19","url":"https://otx.alienvault.com/pulse/6adbabda1387f621bb68b955","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","tags":["Patch","Third Party Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","tags":["Third Party Advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22965","tags":["Mitigation","Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","tags":["Patch","Third Party Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","tags":["Third Party Advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22965","tags":["Mitigation","Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/970766","tags":["US Government Resource"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the \"/tmp\" directory and changing its permissions to make it executable using \"chmod.\" The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the \"/tmp\" directory and changing its permissions to make it executable using \"chmod.\" The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"▪ Spring Core RCE (CVE-2022-22965)","start":42909,"end":42943}]},{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"has alerts for the following vulnerabilities and exploits which may be tied to Zerobot activity:\nCVE-2014-8361\nCVE-2016-20017\nCVE-2017-17105\nCVE-2017-17215\nCVE-2018-10561\nCVE-2018-20057\nCVE-2019-10655\nCVE-2020-7209\nCVE-2020-10987\nCVE-2020-25506\nCVE-2021-35395\nCVE-2021-36260\nCVE-2021-42013\nCVE-2021-46422\nCVE-2022-22965","start":11860,"end":12179},{"quote":"threat activity group detected\nAn active ‘PrivateLoader’ malware process was detected while executing\n‘Morila’ malware was prevented\n‘Multiverze’ malware was detected\nMicrosoft Defender for Endpoint also has detections for the following vulnerabilities exploited by Zerobot:\nCVE-2022-22965","start":12685,"end":12974}]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-beans","vulnerableRanges":["<5.2.20.RELEASE",">=5.3.0, <5.3.18"],"patched":["5.2.20.RELEASE","5.3.18"],"from":["GHSA-36p3-wjmg-h94x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":["<5.2.20.RELEASE",">=5.3.0, <5.3.18"],"patched":["5.2.20.RELEASE","5.3.18"],"from":["GHSA-36p3-wjmg-h94x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-web","vulnerableRanges":["<2.5.12",">=2.6.0, <2.6.6"],"patched":["2.5.12","2.6.6"],"from":["GHSA-36p3-wjmg-h94x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":["<5.2.20.RELEASE",">=5.3.0, <5.3.18"],"patched":["5.2.20.RELEASE","5.3.18"],"from":["GHSA-36p3-wjmg-h94x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-webflux","vulnerableRanges":["<2.5.12",">=2.6.0, <2.6.6"],"patched":["2.5.12","2.6.6"],"from":["GHSA-36p3-wjmg-h94x"],"provenance":"source"}],"advisories":[{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-beans","vulnerableRanges":["<5.2.20.RELEASE"],"patched":["5.2.20.RELEASE"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-beans","vulnerableRanges":[">=5.3.0, <5.3.18"],"patched":["5.3.18"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":["<5.2.20.RELEASE"],"patched":["5.2.20.RELEASE"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=5.3.0, <5.3.18"],"patched":["5.3.18"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-web","vulnerableRanges":["<2.5.12"],"patched":["2.5.12"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-web","vulnerableRanges":[">=2.6.0, <2.6.6"],"patched":["2.6.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":["<5.2.20.RELEASE"],"patched":["5.2.20.RELEASE"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":[">=5.3.0, <5.3.18"],"patched":["5.3.18"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-webflux","vulnerableRanges":["<2.5.12"],"patched":["2.5.12"],"provenance":"source","from":"GHSA"},{"id":"GHSA-36p3-wjmg-h94x","url":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-starter-webflux","vulnerableRanges":[">=2.6.0, <2.6.6"],"patched":["2.6.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1283","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1283","exploited":true,"exploitedSince":"2022-04-04","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":88,"skipped":12,"earliest":"2022-03-30","earliestUrl":"https://github.com/BobTheShoplifter/Spring4Shell-POC","repos":[{"name":"BobTheShoplifter/Spring4Shell-POC","url":"https://github.com/BobTheShoplifter/Spring4Shell-POC","stars":379,"created":"2022-03-30"},{"name":"reznok/Spring4Shell-POC","url":"https://github.com/reznok/Spring4Shell-POC","stars":326,"created":"2022-03-31"},{"name":"tpt11fb/SpringVulScan","url":"https://github.com/tpt11fb/SpringVulScan","stars":153,"created":"2022-06-19"},{"name":"TheGejr/SpringShell","url":"https://github.com/TheGejr/SpringShell","stars":130,"created":"2022-03-30"},{"name":"zangcc/CVE-2022-22965-rexbb","url":"https://github.com/zangcc/CVE-2022-22965-rexbb","stars":102,"created":"2022-12-28"}]},"metasploit":[{"name":"Spring Framework Class property RCE (Spring4Shell)","module":"exploit/multi/http/spring_framework_rce_spring4shell","type":"exploit","disclosureDate":"2022-03-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spring_framework_rce_spring4shell.rb"}],"nuclei":[{"id":"CVE-2022-22965","name":"Spring - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-22965.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22965.yaml"}],"first":{"date":"2022-03-30","source":"PoC-in-GitHub","url":"https://github.com/BobTheShoplifter/Spring4Shell-POC"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2022-03-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2022-03-31","url":"https://github.com/BobTheShoplifter/Spring4Shell-POC","provenance":"source"},{"date":"2022-04-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","provenance":"source"},{"date":"2022-04-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-04-04","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-04","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1283","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":3},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1671 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 NVD exploit link; 88 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-vmware-spring-framework-cve-2022-22965","children":[{"from":"CVE-2022-22965","to":"CVE-2022-22970","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-beans","fromFixed":"5.2.20.RELEASE","toFixed":"5.2.22.RELEASE","daysApart":41},{"kind":"same-code","provenance":"machine","files":["spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java"],"commits":["https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15","https://github.com/spring-projects/spring-framework/commit/50177b1ad3485bd44239b1756f6c14607476fcf2","https://github.com/spring-projects/spring-framework/commit/83186b689f11f5e6efe7ccc08fdeb92f66fcd583"],"basis":"shared function","functions":["CachedIntrospectionResults","introspectInterfaces"]}]}],"packageHistory":[{"cve":"CVE-2016-9878","published":"2016-12-29","fixed":"4.3.5","kev":false},{"cve":"CVE-2020-5397","published":"2020-01-17","fixed":"5.2.3","kev":false},{"cve":"CVE-2020-5398","published":"2020-01-16","fixed":"5.2.3.RELEASE","kev":false},{"cve":"CVE-2022-22965","published":"2022-04-01","fixed":"5.3.18","kev":true},{"cve":"CVE-2024-38828","published":"2024-11-18","fixed":"5.3.42","kev":false},{"cve":"CVE-2023-20860","published":"2023-03-27","fixed":"6.0.7","kev":false,"link":{"from":"CVE-2022-22965","to":"CVE-2023-20860","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webmvc","fromFixed":"5.3.18","toFixed":"5.3.26","daysApart":360}]}},{"cve":"CVE-2023-34053","published":"2023-11-28","fixed":"6.0.14","kev":false}],"package":"Maven:org.springframework:spring-webmvc"}}