CVE-2022-22965 Scanner
CVE-2022-22965 scanner - Remote Code Execution (RCE) vulnerability in Spring Framework
Used 3.5k times · 3.4k assets checked · url
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE
CVE-2022-22965
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
spring framework
Updated Oct 12, 2026View on NVD →
S4E scanner
Monitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →