---
id: "CVE-2022-22947"
kind: "vulnerability"
aliases: ["CVE-2022-22947"]
title: "VMware Spring Cloud Gateway: VMware Spring Cloud Gateway Code Injection Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.98253
exploited: true
status: "open"
category: "runtime"
products: [{"name": "VMware Spring Cloud Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "runtime", "self-hosted", "spring-boot", "spring-cloud-gateway"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2022-03-03T22:15:08+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22947", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-22947", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# VMware Spring Cloud Gateway: VMware Spring Cloud Gateway Code Injection Vulnerability

Spring Cloud Gateway applications are vulnerable to code injection when the Gateway Actuator endpoint is enabled, exposed and unsecured. An unauthenticated attacker who can reach that endpoint can inject code and run it on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware Spring Cloud Gateway affected ? fixed ?

## How to check

Check whether management.endpoint.gateway.enabled is true or the gateway actuator is exposed via management.endpoints.web.exposure.include in application config.
Check whether Spring Security protects the /actuator/gateway paths.

## Fix

Upgrade Spring Cloud Gateway to a fixed release per the VMware advisory; the fixed versions are not stated in the sources.
If upgrading is not possible, disable the gateway actuator endpoint or require authentication on it.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-22947
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-22947
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-22947

## From the sources

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_