VMware Spring Cloud Gateway vulnerabilities

7 CVEs affecting VMware Spring Cloud Gateway, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47879, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability, published 2022-03-03. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2022-05-16. EPSS: 98.3% chance of exploitation in the next 30 days. In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote…
CVE-2022-22946, published 2022-03-04. Medium severity, CVSS 5.5. EPSS: 4.8% chance of exploitation in the next 30 days. In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure…
CVE-2021-22051, published 2021-11-08. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following…
CVE-2025-41235, published 2025-05-30. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
CVE-2026-47879, published 2026-08-27. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 -…
CVE-2026-47825, published 2026-06-15. High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days. Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway…
CVE-2026-22750, published 2026-04-10. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used…