WaratekVRT Sign in

CVE-2022-22965

Affected software11 products, listed below
Severity9.8 Critical CVSS 3.1 3 scores
Fixed in5.2.20.RELEASE, 5.3.18
WeaknessCode injection (CWE-94)
Published1 Apr 2022
Updated17 Jun 2026

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CWE-74

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-04-04 · remediation due 2022-04-25 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 34 citations · honeypot sightings · 87 exploits · earliest 2022-04-04.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 91 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2022-03-30.
  • EPSS 99.6% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-22965 in VulnCheck (free account), which lists 29 more citations and 82 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 837 days 2023-11-15 to 2026-11-10
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 17 days 2026-01-24 to 2026-10-17
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-04-04
Reported exploitation trendmicro.com /en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html 2022-04-08
Reported exploitation unit42.paloaltonetworks.com /recent-exploits-network-security-trends 2022-08-19
Reported exploitation fortinet.com /blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities 2022-12-06
Reported exploitation blog.netlab.360.com /new-ddos-botnet-wszeor 2022-12-07
Exploit reference VulnCheck XDB 697638d15686 Exploit type: initial-access 2022-03-26
Exploit reference VulnCheck XDB 30bd37a7b9c8 Exploit type: initial-access 2022-03-30
Exploit reference VulnCheck XDB 4ae197406cec Exploit type: initial-access 2022-03-30
Exploit reference VulnCheck XDB b2f106eac2b1 Exploit type: initial-access 2022-03-30
Exploit reference VulnCheck XDB b383e52d60dd Exploit type: initial-access 2022-03-30
IndexArtifactStarsFirst seen
GitHub PoC Spring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965 379 2022-03-30
Nuclei Spring - Remote Code Execution
Metasploit Spring Framework Class property RCE (Spring4Shell) (manual rank)
GitHub PoC Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit 326 2022-03-31
Nuclei Spring Framework RCE via Data Binding on JDK 9+
GitHub PoC burpsuite 的Spring漏洞扫描插件。SpringVulScan：支持检测：路由泄露|CVE-2022-22965|CVE-2022-22963|CVE-2022-22947|CVE-2016-4977 153 2022-06-19
GitHub PoC Spring4Shell - Spring Core RCE - CVE-2022-22965 130 2022-03-30
GitHub PoC CVE-2022-22965\Spring-Core-RCE核弹级别漏洞的rce图形化GUI一键利用工具，基于JavaFx开发，图形化操作更简单，提高效率。 102 2022-12-28
GitHub PoC Spring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive) 100 2022-04-07
GitHub PoC SpringFramework 远程代码执行漏洞CVE-2022-22965 72 2022-04-01

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

2 files

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2022-22965.armr patch rule, ARMR 2.6 added 2022-04-01 updated 2026-03-04
Sign in to download
CVE-2022-22965-2.armr patch rule, ARMR 2.6 added 2022-04-01 updated 2026-03-04
Sign in to download

How to mitigate CVE-2022-22965

Upgrade the affected software to a release that fixes it: 5.2.20.RELEASE or 5.3.18. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Fusion Middleware / Third Party (Spring Framework) (12.2.1.4.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Fusion Middleware / MFT Runtime Server (Spring Framework) (12.2.1.4.0)
Oracle Fusion Middleware / Third Party (Spring Framework) (12.2.1.4.0)
Oracle Insurance Applications / Logger (Spring Framework) (1.0.1.8)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Commerce / Content Acquisition System (Spring Framework) (11.3.2)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Commerce / Endeca Integration (Spring Framework) (11.3.2)
Oracle Communications / BSF (Spring Framework) (22.1.3)
Oracle Communications Applications / TMF APIs (Spring Framework) (7.4.1, 7.4.2, 7.5.0)
Oracle Fusion Middleware / Third Party Tools, Samples (Spring Framework) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Retail Applications / BDI Job Scheduler (Spring Framework) (16.0.3)
Oracle Retail Applications / Foundation (Spring Framework) (16.0.3, 19.0.1)
Oracle Retail Applications / PeopleSoft Integration Bugs (Spring Framework) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / RIB Kernal (Spring Framework) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / Security (Spring Framework) (17.0, 18.0, 19.0)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications / Automation Test Suite (Spring Framework) (1.9.0, 22.1.0)
Oracle Communications / CMP (Spring Framework) (12.6.0.0.0)
Oracle Communications / CNC Console (Spring Framework) (1.9.0, 22.1.0)
Oracle Communications / DB Tier (Spring Framework) (1.10.0, 22.1.0)
Oracle Communications / Management (Spring Framework) (9.0, 9.1)
Oracle Communications / NEF (Spring Framework) (22.1.0)
Oracle Communications / NSSF (Spring Framework) (22.1.0, 1.8.0)
Oracle Communications / OC SEPP (Spring framework) (1.7.0, 22.1.0)
Oracle Communications / OCNRF (Spring Framework) (1.15.0, 22.1.0)
Oracle Communications / Policy (Spring Framework) (1.15.0, 22.1.0)
Oracle Communications / UDR (Spring Framework) (1.15.0, 22.1.0)
Oracle Financial Services Applications / BD (Spring Framework) (8.1.1.0, 8.1.1.1, 8.1.2.0)
Oracle Financial Services Applications / Installers (Spring Framework) (8.1.1.0, 8.1.1.1, 8.1.2.0)
Oracle Financial Services Applications / Others (Spring Framework) (8.1.1.0, 8.1.2.0)
Oracle MySQL / Monitoring: General (Spring Framework) (8.0.29 and prior)
Oracle's note: The patch for CVE-2022-22965 also addresses CVE-2022-22968.
Oracle Retail Applications / Xenvironment (Spring Framework) (20.0.1, 21.0.0)
Oracle Supply Chain / Installer (Spring Framework) (3.6.1.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Commerce Content Acquisition System (Spring Framework) 11.3.2 11.3.2
Oracle Commerce Endeca Integration (Spring Framework) 11.3.2 11.3.2
Oracle Communications Automation Test Suite (Spring Framework) 1.9.0, 22.1.0 1.9.0 · 22.1.0
Oracle Communications BSF (Spring Framework) 22.1.3 22.1.3
Oracle Communications CMP (Spring Framework) 12.6.0.0.0 12.6.0.0.0
Oracle Communications CNC Console (Spring Framework) 1.9.0, 22.1.0 1.9.0 · 22.1.0
Oracle Communications DB Tier (Spring Framework) 1.10.0, 22.1.0 1.10.0 · 22.1.0
Oracle Communications Management (Spring Framework) 9.0, 9.1 9.0 · 9.1
Oracle Communications NEF (Spring Framework) 22.1.0 22.1.0
Oracle Communications NSSF (Spring Framework) 22.1.0, 1.8.0 1.8.0 · 22.1.0
Oracle Communications OC SEPP (Spring framework) 1.7.0, 22.1.0 1.7.0 · 22.1.0
Oracle Communications OCNRF (Spring Framework) 1.15.0, 22.1.0 1.15.0 · 22.1.0
Oracle Communications Policy (Spring Framework) 1.15.0, 22.1.0 1.15.0 · 22.1.0
Oracle Communications UDR (Spring Framework) 1.15.0, 22.1.0 1.15.0 · 22.1.0
Oracle Communications Applications TMF APIs (Spring Framework) 7.4.1, 7.4.2, 7.5.0 7.4.1 · 7.4.2 · 7.5.0
Oracle Financial Services Applications BD (Spring Framework) 8.1.1.0, 8.1.1.1, 8.1.2.0 8.1.1.0 · 8.1.1.1 · 8.1.2.0
Oracle Financial Services Applications Installers (Spring Framework) 8.1.1.0, 8.1.1.1, 8.1.2.0 8.1.1.0 · 8.1.1.1 · 8.1.2.0
Oracle Financial Services Applications Others (Spring Framework) 8.1.1.0, 8.1.2.0 8.1.1.0 · 8.1.2.0
Oracle Fusion Middleware MFT Runtime Server (Spring Framework) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party (Spring Framework) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party Tools, Samples (Spring Framework) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Insurance Applications Logger (Spring Framework) 1.0.1.8 1.0.1.8
Oracle MySQL Monitoring: General (Spring Framework) 8.0.29 and prior
Oracle Retail Applications BDI Job Scheduler (Spring Framework) 16.0.3 16.0.3
Oracle Retail Applications Foundation (Spring Framework) 16.0.3, 19.0.1 16.0.3 · 19.0.1
Oracle Retail Applications PeopleSoft Integration Bugs (Spring Framework) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications RIB Kernal (Spring Framework) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications Security (Spring Framework) 17.0, 18.0, 19.0 17.0 · 18.0 · 19.0
Oracle Retail Applications Xenvironment (Spring Framework) 20.0.1, 21.0.0 20.0.1 · 21.0.0
Oracle Supply Chain Installer (Spring Framework) 3.6.1.0 3.6.1.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.springframework:spring-beans 0 5.2.20.RELEASE unbounded
org.springframework:spring-beans 5.3.0 5.3.18 unbounded
org.springframework:spring-webmvc 0 5.2.20.RELEASE unbounded
org.springframework:spring-webmvc 5.3.0 5.3.18 unbounded
org.springframework.boot:spring-boot-starter-web 0 2.5.12 unbounded
org.springframework.boot:spring-boot-starter-web 2.6.0 2.6.6 unbounded
org.springframework:spring-webflux 0 5.2.20.RELEASE unbounded
org.springframework:spring-webflux 5.3.0 5.3.18 unbounded
org.springframework.boot:spring-boot-starter-webflux 0 2.5.12 unbounded
org.springframework.boot:spring-boot-starter-webflux 2.6.0 2.6.6 unbounded

Products and versions

43 products, 99 version entries
SourceVendorProductSchemeAffected versions
nvd cisco cx cloud agent generic ＜ 2.1.0
nvd oracle commerce platform generic 11.3.2
nvd oracle communications cloud native core automated test suite generic 1.9.0 · 22.1.0
nvd oracle communications cloud native core binding support function generic 22.1.3
nvd oracle communications cloud native core console generic 1.9.0 · 22.1.0
nvd oracle communications cloud native core network exposure function generic 22.1.0
nvd oracle communications cloud native core network function cloud native environment generic 1.10.0 · 22.1.0
nvd oracle communications cloud native core network repository function generic 1.15.0 · 22.1.0
nvd oracle communications cloud native core network slice selection function generic 1.8.0 · 1.15.0 · 22.1.0
nvd oracle communications cloud native core policy generic 1.15.0 · 22.1.0
nvd oracle communications cloud native core security edge protection proxy generic 1.7.0 · 22.1.0
nvd oracle communications cloud native core unified data repository generic 1.15.0 · 22.1.0
nvd oracle communications policy management generic 12.6.0.0.0
nvd oracle communications unified inventory management generic 7.4.1 · 7.4.2 · 7.5.0
nvd oracle financial services analytical applications infrastructure generic 8.1.1 · 8.1.2.0
nvd oracle financial services behavior detection platform generic 8.1.1.0 · 8.1.1.1 · 8.1.2.0
nvd oracle financial services enterprise case management generic 8.1.1.0 · 8.1.1.1 · 8.1.2.0
nvd oracle mysql enterprise monitor generic ＜ 8.0.29
nvd oracle product lifecycle analytics generic 3.6.1
nvd oracle retail bulk data integration generic 16.0.3
nvd oracle retail customer management and segmentation foundation generic 17.0 · 18.0 · 19.0
nvd oracle retail financial integration generic 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
nvd oracle retail integration bus generic 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
nvd oracle retail merchandising system generic 16.0.3 · 19.0.1
nvd oracle retail xstore point of service generic 20.0.1 · 21.0.0
nvd oracle sd-wan edge generic 9.0 · 9.1
nvd oracle weblogic server generic 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
osv org.springframework spring-beans generic ＜ 5.2.20 · ≥ 5.3.0 and ＜ 5.3.18
osv org.springframework spring-webflux generic ＜ 5.2.20 · ≥ 5.3.0 and ＜ 5.3.18
osv org.springframework spring-webmvc generic ＜ 5.2.20 · ≥ 5.3.0 and ＜ 5.3.18
osv org.springframework.boot spring-boot-starter-web generic ＜ 2.5.12 · ≥ 2.6.0 and ＜ 2.6.6
osv org.springframework.boot spring-boot-starter-webflux generic ＜ 2.5.12 · ≥ 2.6.0 and ＜ 2.6.6
nvd siemens operation scheduler generic ＜ 2.0.4
nvd siemens simatic speech assistant for machines generic ＜ 1.2.1
nvd siemens sinec network management system generic ＜ 1.0.3
nvd siemens sipass integrated generic 2.80 · 2.85
nvd siemens siveillance identity generic 1.5 · 1.6
nvd veritas access appliance generic 7.4.3 · 7.4.3.100 · 7.4.3.200
nvd veritas flex appliance generic 1.3 · 2.0 · 2.0.1 · 2.0.2 · 2.1
nvd veritas netbackup appliance generic 4.0 · 4.0.0.1:maintenance_release1 · 4.0.0.1:maintenance_release2 · 4.0.0.1:maintenance_release3 · 4.1 · 4.1.0.1:maintenance_release1 · 4.1.0.1:maintenance_release2
nvd veritas netbackup flex scale appliance generic 2.1 · 3.0
nvd veritas netbackup virtual appliance generic 4.0 · 4.0.0.1:maintenance_release1 · 4.0.0.1:maintenance_release2 · 4.0.0.1:maintenance_release3 · 4.1 · 4.1.0.1:maintenance_release1 · 4.1.0.1:maintenance_release2
nvd vmware spring framework generic ＜ 5.2.20 · ≥ 5.3.0 and ＜ 5.3.18

References

URLTags
https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15 WEB
https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf WEB
https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12 WEB
https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6 WEB
https://github.com/spring-projects/spring-framework PACKAGE
https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE WEB
https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18 WEB
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 WEB
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement WEB
https://tanzu.vmware.com/security/cve-2022-22965 WEB

Timeline
Published2022-04-01By the CVE Program.
ARMR remediation created2022-04-01Earliest commit adding this CVE's ARMR patch or security rule.
Added to CISA KEV2022-04-04Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2022-04-04Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.