CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days.

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Affected products

Cisco Cx Cloud Agent: before 2.1.0 (fixed in 2.1.0)
Oracle Commerce Platform: version 11.3.2 only
Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Binding Support Function: version 22.1.3 only
Oracle Communications Cloud Native Core Console: version 1.9.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Network Exposure Function: version 22.1.0 only
Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only; version 1.15.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Policy: version 1.15.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.7.0 only; version 22.1.0 only
Oracle Communications Cloud Native Core Unified Data Repository: version 1.15.0 only; version 22.1.0 only
Oracle Communications Policy Management: version 12.6.0.0.0 only
Oracle Communications Unified Inventory Management: version 7.4.1 only; version 7.4.2 only; version 7.5.0 only
Oracle Financial Services Analytical Applications Infrastructure: version 8.1.1 only; version 8.1.2.0 only
Oracle Financial Services Behavior Detection Platform: version 8.1.1.0 only; version 8.1.1.1 only; version 8.1.2.0 only
Oracle Financial Services Enterprise Case Management: version 8.1.1.0 only; version 8.1.1.1 only; version 8.1.2.0 only
Oracle MySQL Enterprise Monitor: before 8.0.29 (fixed in 8.0.29)
Oracle Product Lifecycle Analytics: version 3.6.1 only
Oracle Retail Bulk Data Integration: version 16.0.3 only
Oracle Retail Customer Management And Segmentation Foundation: version 17.0 only; version 18.0 only; version 19.0 only
Oracle Retail Financial Integration: version 14.1.3.2 only; version 15.0.3.1 only; version 16.0.3 only; version 19.0.1 only
Oracle Retail Integration Bus: version 14.1.3.2 only; version 15.0.3.1 only; version 16.0.3 only; version 19.0.1 only
Oracle Retail Merchandising System: version 16.0.3 only; version 19.0.1 only
Oracle Retail Xstore Point Of Service: version 20.0.1 only; version 21.0.0 only
and 13 more

Published 2022-04-01. Last modified 2026-06-17.