CVE-2022-22963

KEVVMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

Description

When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedApr 1, 2022

Last modifiedJun 17, 2026

Added to KEVAug 25, 2022

Remediation dueSep 15, 2022

References

packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.htmlExploitThird Party Advisory
psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005Third Party Advisory
tanzu.vmware.com/security/cve-2022-22963Vendor Advisory
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxHThird Party Advisory
oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1502 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 99.9% · top 1% of all CVEs
Weakness: CWE-94
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.