Is CVE-2022-22965 (Spring Framework JDK 9+ Remote Code Execution) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-22965 to its Known Exploited Vulnerabilities catalogue on 4 April 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

What “being exploited in the wild” means for CVE-2022-22965

For this CVE, the practical question is not whether the flaw exists, but whether exploitation is already happening at scale. CISA’s KEV listing is the strongest operational signal you should use here, because it indicates observed active exploitation, not just theoretical risk. For Spring environments, that means exposure can move from patch-planning to incident-response urgency very quickly.

That distinction matters because remote code execution changes the response profile. If the vulnerable Spring MVC or Spring WebFlux application is reachable and running on a susceptible JDK 9+ configuration, the issue is not only code quality or upgrade hygiene, it becomes a live compromise path that can be weaponised for initial access, payload delivery, and follow-on activity.

How to confirm whether your environment is actually exposed

The first check is whether you run the affected Spring components in the runtime condition named in the advisory, then whether any internet-facing or internally reachable application accepts the data binding path an attacker would target. If you cannot quickly answer both questions from inventory alone, treat that as a visibility gap, not as evidence of safety.

Confirmed exposure should be narrowed by application role, reachability, and whether the service can execute server-side actions if input is manipulated. For a live hunting pass, focus on web access logs, unusual request parameters, unexpected child processes, and signs that the application hosted execution rather than merely handling requests.

What to do if patching or upgrade cannot happen immediately

If the fix cannot be applied at once, treat the service as high risk and reduce attack surface immediately. Prioritise isolation of externally reachable instances, tighten network paths to the application, and remove any unnecessary functionality that expands the binding surface. This is a temporary risk reduction step, not a substitute for remediation.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for the authoritative remediation path, and do not rely on third-party summaries for version or mitigation details. The key operational issue is speed, because KEV inclusion means attackers are likely already doing the same triage you are.

Risk and Threat Considerations

Once a Spring RCE flaw is actively exploited, the main risk is full application compromise with potential lateral movement into adjacent systems, especially where the application can reach internal services or hold credentials. Exposure is amplified when the service has broad network access, privileged runtime permissions, or access to secrets and downstream APIs.

Failure mechanism: The attacker supplies crafted input that abuses server-side data binding to reach unintended code execution, then uses that foothold to run commands, stage payloads, or harvest credentials and configuration material.

Impact: A successful exploit can lead to web shell deployment, data theft, internal reconnaissance, account abuse, service disruption, or further compromise of connected systems and identities.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation requires rapid identification and remediation of exposed vulnerable services.
Recommendation — Prioritise vulnerable Spring services by exposure and exploitability, then verify remediation and hunting coverage.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about a known exploited CVE and confirms whether vulnerable systems are exposed.
	SI-2 — Flaw Remediation	Exploit-in-the-wild status makes timely remediation the core control response.
Recommendation — Continuously scan for vulnerable Spring instances and validate remediation against current threat intelligence. Apply and verify the vendor fix quickly, then track exceptions until the flaw is removed.
NIST CSF 2.0	RS.AN-03 — Analysis	Observed exploitation requires analysis of indicators and compromise evidence after remediation.
	GV.RM-03 — Legal and Regulatory Requirements	KEV-driven remediation affects prioritization and governance for known exploited vulnerabilities.
Recommendation — Analyze affected systems for exploit indicators and preserve findings for incident response. Use KEV status to escalate remediation priority and document risk acceptance only when unavoidable.

Practitioner Guidance

What to prioritise: Start with internet-facing Spring applications, then internal services that can still be reached from user-facing tiers or management networks. If you have many Spring-based services, rank them by exposure and business-criticality, not by ownership team or patch cadence alone.

What to verify: Confirm that remediation actually removed the risky condition, then check for pre-patch compromise before you declare the service clean. Look for anomalous processes, unexpected outbound connections, and any evidence that the application spawned shells or loaded unfamiliar classes.

Practitioner takeaway: KEV inclusion should shift this from “patch when convenient” to “assume exploitation is plausible until you prove otherwise,” especially for exposed Spring services with broad internal reach.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org