CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-04-04
EPSS: 99.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-01 · updated 2026-06-17
Weakness: CWE-94

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Summary

CVE-2022-22965 is a critical remote code execution flaw in Spring Framework affecting Spring MVC or Spring WebFlux applications running on JDK 9+. Exploitation requires deployment as a WAR on Tomcat, though other vectors may exist. It is actively exploited and listed in CISA KEV, with a public exploit available. Affected products include Cisco CX Cloud Agent (fixed in 2.1.0) and multiple Oracle products. Apply vendor updates immediately; for Spring, upgrade to patched versions per vendor guidance.

CVE-2022-22965 هو ثغرة تنفيذ تعليمات برمجية عن بُعد خطيرة في Spring Framework تؤثر على تطبيقات Spring MVC أو Spring WebFlux التي تعمل على JDK 9+. يتطلب الاستغلال نشر التطبيق كملف WAR على Tomcat، رغم احتمال وجود طرق أخرى. الثغرة مستغلة فعليًا ومدرجة في CISA KEV، مع وجود استغلال عام. تشمل المنتجات المتأثرة Cisco CX Cloud Agent (تم إصلاحها في 2.1.0) والعديد من منتجات Oracle. طبّق تحديثات البائع فورًا؛ بالنسبة لـ Spring، قم بالترقية إلى الإصدارات المصححة وفقًا لإرشادات البائع.

Affected products

Cisco CX Cloud Agent: before 2.1.0 — fixed in 2.1.0
Oracle Corporation Oracle Commerce Platform: 11.3.2
Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0, 22.1.0
Oracle Communications Cloud Native Core Binding Support Function: 22.1.3
Oracle Communications Cloud Native Core Console: 1.9.0, 22.1.0
Oracle Communications Cloud Native Core Network Exposure Function: 22.1.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0, 22.1.0
Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 22.1.0
Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0, 1.15.0, 22.1.0
Oracle Communications Cloud Native Core Policy: 1.15.0, 22.1.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.7.0, 22.1.0
Oracle Communications Cloud Native Core Unified Data Repository: 1.15.0, 22.1.0
Oracle Corporation Communications Policy Management: 12.6.0.0.0
Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1, 7.4.2, 7.5.0
Oracle Corporation Financial Services Analytical Applications Infrastructure: 8.1.1, 8.1.2.0
Oracle Corporation Financial Services Behavior Detection Platform: 8.1.1.0, 8.1.1.1, 8.1.2.0
Oracle Corporation Oracle Financial Services Enterprise Case Management: 8.1.1.0, 8.1.1.1, 8.1.2.0
Oracle Corporation MySQL Enterprise Monitor: before 8.0.29 — fixed in 8.0.29
Oracle Corporation Oracle Product Lifecycle Analytics: 3.6.1
Oracle Corporation Retail Bulk Data Integration: 16.0.3
Oracle Corporation Retail Customer Management and Segmentation Foundation: 17.0, 18.0, 19.0
Oracle Retail Financial Integration: 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
Oracle Corporation Oracle Retail Integration Bus: 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1
Oracle Corporation Retail Merchandising System: 16.0.3, 19.0.1
Oracle Corporation Retail Xstore Point of Service: 20.0.1, 21.0.0
Oracle Corporation SD-WAN Edge: 9.0, 9.1
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Siemens Operation Scheduler: before 2.0.4 — fixed in 2.0.4
Siemens Simatic Speech Assistant For Machines: before 1.2.1 — fixed in 1.2.1
Siemens Sinec Network Management System: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Cisco CX Cloud Agent 2.1.0; Oracle Corporation MySQL Enterprise Monitor 8.0.29; Siemens Operation Scheduler 2.0.4; Siemens Simatic Speech Assistant For Machines 1.2.1; Siemens Sinec Network Management System 1.0.3; Spring Framework 5.2.20, 5.3.18; Maven Org.Springframework.Boot:Spring-Boot-Starter-Web 2.5.12, 2.6.6; Maven Org.Springframework.Boot:Spring-Boot-Starter-Webflux 2.5.12, 2.6.6; Maven Org.Springframework:Spring-Beans 5.2.20.RELEASE, 5.3.18; Maven Org.Springframework:Spring-Webflux 5.2.20.RELEASE, 5.3.18; Maven Org.Springframework:Spring-Webmvc 5.2.20.RELEASE, 5.3.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22965 or the next vulnerability affects your stack