🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2022-22947

10.0

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

spring cloud gateway

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2022-22947 Scanner

Detects 'Remote Code Execution (RCE)' vulnerability in Spring Cloud Gateway affects v. Spring cloud gateway 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions.

Used 3.3k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →