CVE-2022-22978: Netapp Active Iq Unified Manager

Critical severity, CVSS 9.8. EPSS: 12.4% chance of exploitation in the next 30 days.

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected products

• Netapp Active Iq Unified Manager: affected versions not specified
• Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
• VMware Spring Security: before 5.5.7 (fixed in 5.5.7); from 5.6.0, before 5.6.4 (fixed in 5.6.4)

Published 2022-05-19. Last modified 2026-06-17.