CVE-2022-22965 is a JDK 9+ remote code execution vulnerability in VMware Spring Framework. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 April 2022, which means attackers have used it in real attacks. Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
How this vulnerability class works
CVE-2022-22965 is dangerous because it turns ordinary request handling into a code execution path. In a Spring MVC or Spring WebFlux application on JDK 9+, crafted data binding can let an attacker influence server-side behaviour far beyond the intended input validation boundary.
That matters because framework-level RCE is not limited to one feature or one route. Once an application’s binding logic is reachable, the attacker is aiming at the runtime itself, which can expose data, alter application state, and create a foothold for broader compromise.
Why it is high impact in Spring applications
Spring is widely used as the control plane for business logic, so a flaw in its request-to-object binding can be especially severe. A successful exploit may execute with the same permissions as the application process, which often means access to configuration, secrets, internal services, and connected data stores.
Because the vulnerability is in the framework layer, multiple services can share the same exposure pattern if they use the affected request handling model. The risk is not just one vulnerable endpoint, but a repeatable pattern that can appear across many applications built on the same stack.
For current version and fix details, readers should rely on the vendor advisory and the NIST National Vulnerability Database rather than reproducing version guidance here.
How organisations check exposure and reduce blast radius
Exposure checks start with asset inventory and application mapping: identify which services use Spring MVC or Spring WebFlux, where they run, and whether they are exposed to untrusted traffic. Internet-facing systems and externally reachable management interfaces deserve immediate attention.
Remediation should follow the vendor guidance for the exact affected product and deployment model. If a patch cannot be applied immediately, organisations should use compensating controls such as tight inbound filtering, temporary service isolation, and reduction of unnecessary exposure while validating whether the vulnerable path is actually reachable.
NHIMG’s vulnerability management guide is useful here because this kind of issue should be prioritised as an actively exploited vulnerability, not treated as a routine backlog item.
Detection, compromise review, and identity impact
After suspected exploitation or patching, review the application host, logs, and adjacent systems for command execution, unexpected processes, unusual outbound connections, web shell behaviour, and signs that the attacker used the application to reach internal assets. Post-patch review matters because fixing the bug does not remove any access already gained.
Identity impact can be material if the application handled secrets, service credentials, tokens, session material, or signing keys. Rotate any material that may have been exposed, and check whether the application or its service account was used to move laterally or access downstream systems.
Attackers often pair framework RCE with secret theft or token abuse, so the investigation should look beyond the original vulnerable service. A related example of how runtime compromise can lead to secret exposure and broader exploitation is shown in Langflow Flodrix botnet 2025, where RCE was used to expose environment variables and expand attacker control.
Risk and Threat Considerations
Actively exploited RCE in a widely used framework is a high-risk condition because attackers can use it for initial access, persistence, and lateral movement. The main danger is not only code execution itself, but the trusted position the vulnerable application may already hold inside the environment.
Failure mechanism: Crafted input reaches Spring data binding on JDK 9+, allowing attacker-controlled execution inside the application process and any connected trust boundary it can reach.
Impact: The attacker may steal secrets, alter application behaviour, access internal systems, and turn one exposed service into a broader compromise path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | RCE exposure requires rapid flaw remediation and verification. |
| RA-5 — Vulnerability Monitoring and Scanning | This CVE demands continuous exposure discovery and validation across assets. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection and compromise review depend on reviewing logs for exploit traces. | |
| Recommendation — Prioritise patching and verify remediation for the vulnerable Spring deployment. Scan assets to identify affected Spring services and confirm exposure. Review logs and alerts for signs of exploitation and post-exploit activity. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes continuous vulnerability handling directly relevant. |
| CIS-8 — Audit Log Management | Post-exploitation investigation relies on preserved and reviewable logs. | |
| Recommendation — Track, prioritise, and remediate the vulnerable application as an exploited issue. Preserve and review logs to investigate exploitation and follow-on activity. | ||
Practitioner Guidance
Why practitioners should care: Treat this as an emergency exposure review, not a normal vulnerability ticket. For exploited framework RCE, the operational question is whether the service is reachable, whether the vulnerable path is present, and whether the application could have been used as a stepping stone into more sensitive systems.
What to watch for: Look for unexplained process launches, web-access logs followed by shell activity, new outbound connections, and any sign that credentials or tokens were accessed after the exploitation window. If compromise is suspected, rebuild or reimage the service and rotate any secrets it could have touched.
Related resources from NHI Mgmt Group
- CVE-2022-22963 (VMware Tanzu Spring Cloud Function Remote Code Execution)
- Why do Spring Framework property binding flaws create remote code execution risk in Tomcat-based applications?
- CVE-2022-26500 (Veeam Backup & Replication Remote Code Execution)
- CVE-2022-26501 (Veeam Backup & Replication Remote Code Execution)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org