What is the CVSS score of CVE-2026-22727?

CVE-2026-22727 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cloud Foundry are affected by CVE-2026-22727?

Cloud Foundry deployments running vulnerable versions face a critical risk where attackers who bypass perimeter firewalls can hijack applications and steal sensitive data.

How to fix or mitigate CVE-2026-22727?

Within 24 hours: Audit firewall rules and network segmentation to identify and restrict unauthorized access to Cloud Foundry internal endpoints; verify current CF Deployment and Capi Release versions across all environments. Within 7 days: Implement enhanced monitoring and logging on internal Cloud Foundry endpoints; conduct threat assessment to identify critical applications at highest risk of compromise. Within 30 days: Upgrade to patched versions of Cloud Foundry Capi Release and CF Deployment once available; if upgrade timeline extends beyond 30 days, implement network segmentation and WAF rules to restrict access to internal endpoints.

Cloud Foundry CVE-2026-22727

EUVD-2026-12667 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-17 vmware

Authentication Bypass Cloud Foundry

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 23:02 euvd

EUVD-2026-12667

Analysis Generated

Mar 17, 2026 - 23:02 vuln.today

CVE Published

Mar 17, 2026 - 22:45 nvd

HIGH 7.5

DescriptionCVE.org

Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows any user who has bypassed the firewall to potentially replace droplets and therefore applications allowing them to access secure application information.

AnalysisAI

Cloud Foundry CAPI Release contains unprotected internal endpoints that allow attackers who have bypassed perimeter firewall controls to replace application droplets and access sensitive application data. The vulnerability affects Cloud Foundry CAPI Release version 1.226.0 and earlier, and CF Deployment version 54.9.0 and earlier across all platforms. This is an authentication bypass issue (CWE-306) with a CVSS score of 7.5, requiring adjacent network access and high attack complexity but no privileges or user interaction.

Technical ContextAI

Cloud Foundry is a multi-cloud platform-as-a-service (PaaS) application deployment and orchestration system. The vulnerability exists in the Cloud Application Programming Interface (CAPI) Release component, specifically affecting versions 1.226.0 and below (CPE: cpe:2.3:a:cloudfoundry:cloud_foundry:*:*:*:*:*:*:*:*). The root cause is CWE-306 (Missing Authentication for Critical Function), meaning internal API endpoints that control application droplet management lack proper authentication controls. In Cloud Foundry, droplets are the compiled, ready-to-run artifacts of applications; the ability to replace these without authentication allows complete application compromise. The vulnerability assumes the attacker has already bypassed perimeter firewall protections, placing them in an adjacent network position where they can reach these internal endpoints.

RemediationAI

Upgrade Cloud Foundry CAPI Release to version 1.227.0 or later and Cloud Foundry Deployment to version 54.10.0 or later, following guidance in the official Cloud Foundry security advisory at https://www.cloudfoundry.org/blog/cve-2026-22727-unprotected-internal-endpoints. As an interim mitigation while patching is scheduled, implement strict network segmentation to ensure internal CAPI endpoints are not accessible from untrusted network zones, deploy additional authentication controls such as mutual TLS for internal API communications, and monitor for unauthorized access attempts to droplet management endpoints. Review and harden firewall rules to minimize the risk of firewall bypass attacks that would enable exploitation of this vulnerability.