CVE-2022-22947: listed in the CISA KEV catalog CVE-2022-22947 · CVSS 10.0 CRITICAL · EPSS 98% · KEV 2022-05-16
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Is CVE-2022-22947 exploited? Listed in the CISA KEV catalog on 2022-05-16. Federal remediation due 2022-06-06. Past that date by 1607 days. EPSS puts exploitation in the next 30 days at 98%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? Spring Cloud Gateway · Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions oracle · commerce guided search · 11.3.2 oracle · communications cloud native core binding support function · 1.11.0, 22.1.3 oracle · communications cloud native core console · 22.2.0 oracle · communications cloud native core network exposure function · 22.1.0 oracle · communications cloud native core network function cloud native environment · 1.10.0 oracle · communications cloud native core network repository function · 1.15.0, 1.15.1, 22.1.2, 22.2.0 oracle · communications cloud native core network slice selection function · 1.8.0, 22.1.0 oracle · communications cloud native core security edge protection proxy · 22.1.1 oracle · communications cloud native core service communication proxy · 1.15.0 Is there a patch? Patch information is not available in this record.
What PlainSec published about CVE-2022-22947 PlainSec has not published a story about this CVE.
Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-08-11.
CVE-2022-22947: listed in the CISA KEV catalog CVE-2022-22947 · CVSS 10.0 CRITICAL · EPSS 98% · KEV 2022-05-16
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Is CVE-2022-22947 exploited? Listed in the CISA KEV catalog on 2022-05-16. Federal remediation due 2022-06-06. Past that date by 1607 days. EPSS puts exploitation in the next 30 days at 98%. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? Spring Cloud Gateway · Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions oracle · commerce guided search · 11.3.2 oracle · communications cloud native core binding support function · 1.11.0, 22.1.3 oracle · communications cloud native core console · 22.2.0 oracle · communications cloud native core network exposure function · 22.1.0 oracle · communications cloud native core network function cloud native environment · 1.10.0 oracle · communications cloud native core network repository function · 1.15.0, 1.15.1, 22.1.2, 22.2.0 oracle · communications cloud native core network slice selection function · 1.8.0, 22.1.0 oracle · communications cloud native core security edge protection proxy · 22.1.1 oracle · communications cloud native core service communication proxy · 1.15.0 Is there a patch? Patch information is not available in this record.
What PlainSec published about CVE-2022-22947 PlainSec has not published a story about this CVE.
Primary sources What this record does not say KEV and EPSS are re-checked daily. Record last updated 2026-08-11.