Is CVE-2022-22947 (VMware Spring Cloud Gateway Code Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-22947 to its Known Exploited Vulnerabilities catalogue on 16 May 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

How CISA’s KEV listing answers the exploitation question

For this CVE, the practical signal is the KEV listing, not the marketing language around the product. CISA adds entries to the catalogue when there is reliable evidence of active exploitation, so a KEV entry is a strong indicator that exploitation is not theoretical. The right next step is to treat the issue as exposure that may already be in an attacker’s hands, not as a purely prospective vulnerability.

Because the affected condition is tied to an enabled, exposed, and unsecured Gateway Actuator endpoint, exposure is often a deployment decision as much as a software flaw. That means the first question is whether the vulnerable endpoint is reachable from untrusted networks, whether it is protected by access controls, and whether the application is using a configuration that removes the attack path entirely.

What the vulnerability means operationally

Code injection in a gateway component matters because the gateway sits on a high-value trust boundary. If an attacker can reach the vulnerable actuator endpoint, they may be able to execute code in a place that can influence routing, visibility, or downstream services. In practice, that makes the vulnerability a potential entry point rather than an isolated application defect.

The operational implication is that security teams should think in terms of attack path, not just patch status. A vulnerable internet-facing gateway deserves immediate triage, while an internally hosted instance still needs review if it is reachable from lower-trust segments, shared administrative networks, or other systems that an attacker could already control.

How to confirm exposure and assess compromise

Start by identifying every Spring Cloud Gateway deployment and checking whether the Gateway Actuator endpoint is enabled, exposed, and unsecured. If the service is internet-facing, place it in the highest-priority remediation queue. If you cannot patch immediately, confirm whether the endpoint can be disabled, access-restricted, or isolated until the fix is applied.

Then look for signs of earlier compromise. Review gateway and application logs for unusual requests to actuator paths, unexpected command execution, strange outbound connections, new processes, or configuration changes that do not match normal administration. Because code injection can be used to establish follow-on access, also review adjacent systems that the gateway can reach and determine whether any credentials, sessions, or service tokens may have been exposed.

Risk and Threat Considerations

This vulnerability is attractive to attackers because it offers a direct path from exposed management functionality to code execution. Once a gateway is compromised, the attacker may use it as a foothold for reconnaissance, lateral movement, or traffic manipulation, especially if the service has broad network reach or elevated trust inside the environment.

Failure mechanism: An exposed actuator endpoint provides an attacker with an input channel into a privileged application surface, and code injection turns that surface into execution capability.

Impact: The result can be full application compromise, downstream service exposure, and the need to assume adjacent credentials, tokens, or session material may also have been accessed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	KEV-listed exploitation requires identifying exposed vulnerable assets.
Recommendation — Identify exposed Spring Cloud Gateway instances and prioritise them for remediation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation makes timely remediation the core control response.
	AC-4 — Information Flow Enforcement	The issue hinges on whether the actuator endpoint is exposed to untrusted reachability.
Recommendation — Remediate the vulnerable gateway configuration or software as soon as possible. Restrict access to the actuator endpoint so untrusted networks cannot reach it.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV presence and exploitation status make prioritised vulnerability handling essential.
Recommendation — Prioritise and track remediation for the vulnerable gateway until exposure is removed.
OWASP ASVS	V13 — Configuration	The attack path depends on insecure application configuration and exposed management functions.
Recommendation — Harden the gateway configuration and disable unnecessary management exposure.

Practitioner Guidance

What to prioritise: Use CISA Known Exploited Vulnerabilities Catalog to confirm the exploitation status, and treat any reachable deployment as urgent until exposure is removed or contained.

What to verify: Confirm whether the Gateway Actuator endpoint is disabled, bound to trusted networks only, or protected by a control that truly prevents unauthorised access. If the service cannot be secured quickly, isolate it and document the exception rather than leaving it reachable by default.

What to measure: Track how many gateway instances are still exposed, how quickly they are remediated after discovery, and whether any show evidence of suspicious requests or follow-on activity. A low patch count is not enough if the vulnerable endpoint remains reachable.

Practitioner takeaway: For KEV-listed flaws like this one, exposure management matters as much as patching. If the vulnerable endpoint is reachable, assume exploitation is a live possibility until you have verified containment, remediation, and absence of compromise.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org