CVE-2022-22947 KEVPublic exploit Critical · 10.0 EPSS 98.3%

VMware Spring Cloud Gateway Code Injection Vulnerability

VMware · Spring Cloud Gateway

Summary

VMware Spring Cloud Gateway contains a code injection flaw in its Gateway Actuator endpoint, which is exploitable when that endpoint is enabled, exposed and left unsecured. An unauthenticated remote attacker who can reach the endpoint can send a maliciously crafted request that results in arbitrary code execution on the host, with no user interaction required.

Official description · NVD

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Breakdown

70.0 / 100

Exploited: Yes, in CISA KEV
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource data149 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules
What can follow
- Encrypt files for ransomT1486 · Data Encrypted for ImpactSource data17 general detection rules

First seen exploited 55 days after disclosure. Public exploit code (Metasploit) was available 36 days before disclosure.

Public exploit codeMetasploit26 Jan 202236 days before
Disclosed3 Mar 2022day 0
First seen exploitedVulnCheck KEV evidence27 Apr 2022+55 days
Added to CISA KEVEU database agrees16 May 2022+2 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

3 fixes in spring-cloud-gateway over 4 years. The latest fix listed for spring-cloud-gateway is 4.2.1.

Fixes in spring-cloud-gatewayMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

3.0.5CVE-2021-220518 Nov 2021
3.1.1CVE-2022-229473 Mar 2022KEV
4.2.1CVE-2026-2275010 Apr 2026Latest listed

techniques

3 , grouped by in kill-chain order 3

Initial AccessTA0001

Exploit Public-Facing Application T1190

MITRE CTID mapping of the KEV entry · how it is exploited

This vulnerability is exploited by a remote attacker via a code injection attack to gain perform arbitrary remote code execution. CISA has linked this vulnerability to adversary campaigns performed by Andariel to perform cyber espionage via ransomware operations.

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the KEV entry · primary impact

ImpactTA0040

Data Encrypted for Impact T1486

MITRE CTID mapping of the KEV entry · follow-on activity

Detection

0 rules for this CVE · 261 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-22947 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Data Encrypted for ImpactT148617 general rules

LockerGoga Ransomware Activitycriticalstable
Antivirus - Ransomware Signaturecriticaltest
Potential Conti Ransomware Activitycriticaltest
WannaCry Ransomware Activitycriticaltest
BlueSky Ransomware Artefactshightest
Load Of RstrtMgr.DLL By A Suspicious Processhightest
Renamed Gpg.EXE Executionhightest
Suspicious Reg Add BitLockerhightest

All 17 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.springframework.cloud:spring-cloud-gateway.

Mavenorg.springframework.cloud:spring-cloud-gatewayGHSA-3gx9-37ww-9qw6

Upgrade to 3.1.1 or later

Set the version to 3.1.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2022-22947. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you run	Upgrade to
3.1.0 up to 3.1.1	3.1.1
All versions before 3.0.7	3.0.7

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag (5 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 16 May 2022. Federal due date 6 Jun 2022. No recorded ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 16 May 2022. EUVD-2022-1288

Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)EDB-50799 · webapps · java · 2022-03-07

, 30 Oct 2026

98.3%Top 0.08%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.92%).

3.1

10.0Critical · 10.0

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1648 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9992 20.0/20

Threat reports0 reports 0.0/10

Public exploit code2 NVD references tagged Exploit; 1 Exploit-DB entry; 57 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 10.0 7.0/7

End-of-life productsupported or unknown 0.0

Total70.0

Record

Published: 3 Mar 2022
Modified: 17 Jun 2026
: CWE-917 Improper Neutralization of Special Elements used in an Expression Language StatementCWE-94 Improper Control of Generation of Code
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

3What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in spring-cloud-gatewayMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

Patch 2

US Government Resource 1

Third Party Advisory 2

How attackers get in

What they do

What can follow

techniques