CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-08-25. EPSS: 99.9% chance of exploitation in the next 30 days.

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Affected products

Oracle Banking Branch: version 14.5 only
Oracle Banking Cash Management: version 14.5 only
Oracle Banking Corporate Lending Process Management: version 14.5 only
Oracle Banking Credit Facilities Process Management: version 14.5 only
Oracle Banking Electronic Data Exchange For Corporates: version 14.5 only
Oracle Banking Liquidity Management: version 14.2 only; version 14.5 only
Oracle Banking Origination: version 14.5 only
Oracle Banking Supply Chain Finance: version 14.5 only
Oracle Banking Trade Finance Process Management: version 14.5 only
Oracle Banking Virtual Account Management: version 14.5 only
Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Console: version 1.9.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.0 only
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only; version 22.1.0 only; version 22.1.2 only
Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Policy: version 1.15.0 only; version 22.1.0 only; version 22.1.3 only
Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.7.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.15.0 only; version 22.1.0 only
Oracle Communications Communications Policy Management: version 12.6.0.0.0 only
Oracle Financial Services Analytical Applications Infrastructure: version 8.1.1.0 only; version 8.1.2.0 only
Oracle Financial Services Behavior Detection Platform: version 8.1.1.0 only; version 8.1.1.1 only; version 8.1.2.0 only
Oracle Financial Services Enterprise Case Management: version 8.1.1.0 only; version 8.1.1.1 only; version 8.1.2.0 only
Oracle MySQL Enterprise Monitor: up to and including 8.0.29
Oracle Product Lifecycle Analytics: version 3.6.1.0 only
and 3 more

Published 2022-04-01. Last modified 2026-06-17.