CVE-2022-22965: Spring Framework data binding remote code execution (Spring4Shell)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, near-certain EPSS probability, and public exploit code make this an urgent, actively exploited RCE in a ubiquitous framework.

What it is

Spring MVC and Spring WebFlux applications on JDK 9+ can be exploited through data binding to achieve remote code execution. The known exploit path requires a Tomcat WAR deployment, though the underlying flaw is more general and other exploitation methods may exist. This is a critical, unauthenticated network-reachable flaw in a widely deployed framework.

Impact

An unauthenticated attacker can execute arbitrary code on the application server, leading to full host compromise, data theft, and lateral movement. Successful exploitation gives the attacker the privileges of the application process.

Attack surface

Reachable over the network via HTTP requests to a vulnerable Spring MVC or WebFlux endpoint; no authentication or user interaction is required per the CVSS vector. The documented exploit specifically targets applications deployed as WAR files on Tomcat with JDK 9 or later.

Exploitation

CVE-2022-22965 is listed in CISA KEV with a 2022-04-25 remediation due date, and EPSS shows a 30-day probability of 0.99638 (99.6th percentile). Public exploit code is referenced in Packet Storm advisories, confirming active exploitation in the wild.

What to do

• Upgrade Spring Framework to a fixed release per the VMware Tanzu advisory and apply vendor patches for affected products (Oracle, Cisco, Siemens, Veritas).
• If immediate patching is not possible, apply the vendor-recommended mitigation (e.g., DataBinder disallowed fields) or deploy as a Spring Boot executable jar rather than a Tomcat WAR.
• Remove or restrict unnecessary Tomcat access log and other writable classpath directories that the exploit abuses.
• Inventory all Spring MVC/WebFlux applications on JDK 9+ and prioritize internet-facing and WAR-deployed instances.
• Monitor vendor advisories for updated guidance, as the flaw is more general than the initial Tomcat WAR exploit path.

Detection

• Hunt for HTTP requests containing class.module.classLoader patterns or other suspicious data-binding parameter names in web access logs.
• Monitor for unexpected creation or modification of JSP files, especially under Tomcat access log or webapp directories.
• Alert on outbound network connections or child processes spawned by the Java application server that are not part of normal behavior.
• Use file integrity monitoring on web application directories and classpath locations to detect dropped webshells.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.