CVE-2022-22947 is a code injection vulnerability in VMware Spring Cloud Gateway. CISA added it to the Known Exploited Vulnerabilities catalogue on 16 May 2022, which means attackers have used it in real attacks. Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
What makes this vulnerability dangerous in Spring Cloud Gateway
Code injection in an application gateway is dangerous because the gateway sits on a high-trust path between users, back-end services, and administrative functions. When the actuator endpoint is enabled, exposed, and unsecured, an attacker may be able to reach management capabilities that were never intended to be internet-facing.
That combination turns a configuration weakness into a direct execution path. A gateway is not just another web app, it often brokers traffic for many services, so successful injection can affect more than the vulnerable instance itself.
How organisations determine exposure
Exposure starts with identifying every Spring Cloud Gateway deployment, then checking whether the actuator endpoint is enabled, reachable, and protected. Internet-facing instances deserve immediate attention, but internal exposure also matters if untrusted users, partner networks, or shared environments can reach the management surface.
Vendor advisories and the NIST National Vulnerability Database are the authoritative places to confirm the advisory record, while the CVE Program provides the canonical identifier and record structure. For prioritisation across the broader vulnerability queue, NHI Management Group’s Vulnerability Management Guide is useful for understanding how KEV inclusion changes urgency.
Because CISA added this CVE to KEV, exposure should be treated as active risk rather than theoretical weakness. In practice, that means confirming whether the vulnerable product is present before assuming it is not in use.
Remediation and compensating controls
The preferred response is to apply the vendor’s fixed release and remove the attack path that makes the management endpoint reachable. Until patching is complete, the main compensating control is to stop unauthorised access to the actuator surface by restricting network reachability, hardening authentication, and removing unnecessary exposure.
Where patch timing is constrained, reduce blast radius by isolating the gateway, limiting administrative access, and monitoring for any request patterns that indicate probing of management endpoints. If the gateway is shared across multiple applications, coordinate remediation carefully so that temporary controls do not break required routing or operational management.
Detection, compromise review, and identity impact
Post-exploitation review should look for signs that the gateway was used as an execution point, not just as a configuration target. That includes unusual management requests, unexpected process behaviour, new outbound connections, and any evidence that code was injected to reach downstream services.
If exploitation is suspected, review adjacent credentials, sessions, API keys, certificates, and service accounts that the gateway can access. Injection in a gateway can become a stepping stone to broader compromise when the attacker reuses trusted access paths or harvests material that the gateway handles on behalf of other systems.
For organisations that want a broader exploitation lens, the MITRE ATT&CK Enterprise Matrix is a useful reference for mapping post-compromise actions such as execution, persistence, and lateral movement, while NHI Management Group’s State of NHI & AI Agent Breach Report shows how stolen secrets and trusted access paths are commonly abused after initial compromise.
Risk and Threat Considerations
This vulnerability is especially dangerous because gateway compromise can create a control-plane problem, not just an application problem. Attackers may use the code injection path to establish execution, pivot into internal services, or stage additional payloads from a trusted entry point.
Failure mechanism: The attacker reaches an exposed, unsecured actuator endpoint and uses code injection to execute commands or payloads in the gateway context.
Impact: The gateway can become a pivot point for service access, data access, persistence, or wider compromise across systems that trust it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V13 — Configuration | The vulnerability depends on insecure gateway and actuator configuration. |
| Recommendation — Harden management surface configuration and remove unnecessary exposed endpoints. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Code injection exploits unsafe handling of input reaching executable paths. |
| AC-4 — Information Flow Enforcement | Gateway exposure and routing trust boundaries are central to the abuse path. | |
| IA-2 — Identification and Authentication (Organizational Users) | Unsecured actuator access shows a missing authentication control at management boundaries. | |
| Recommendation — Validate and constrain inputs before they reach executable application paths. Enforce flow restrictions so untrusted traffic cannot reach management interfaces. Require strong authentication for administrative and management access. | ||
| NIST CSF 2.0 | PR.AA-05 — Network Integrity is Protected | The issue hinges on exposed management access across trust boundaries. |
| Recommendation — Segment and restrict management access paths to exposed services. | ||
Practitioner Guidance
Why practitioners should care: Treat this class of issue as an asset-inventory and exposure problem, not only a patching problem. If a gateway is internet-facing or reachable from broad internal networks, the operational risk is materially higher because exploitation can be immediate once the vulnerable surface is found.
What to watch for: Prioritise environments where management endpoints are enabled by default, where access controls are inconsistent, or where the gateway is acting as a choke point for multiple services. In those cases, remediation should be validated by verifying that the management surface is no longer reachable and that no compromise artefacts remain.