What is the CVSS score of CVE-2026-22731?

CVE-2026-22731 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-22731?

Spring Boot applications using Actuator endpoints are at risk of authentication bypass, potentially allowing unauthorized access to sensitive application functions and data.. A patch is available.

How to fix or mitigate CVE-2026-22731?

Within 24 hours: Identify all Spring Boot applications using Actuator in your environment and verify their version numbers against the affected ranges. Within 7 days: Implement network segmentation or WAF rules to restrict access to Health Group endpoints and apply the compensating controls listed below. Within 30 days: Monitor vendor communications for patch availability and prepare upgrade procedures; establish a plan to upgrade to patched versions (4.0.3+, 3.5.11+, or 3.4.15+) immediately upon release.

Java CVE-2026-22731

EUVD-2026-13345 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-19 vmware

GHSA-8hfc-fq58-r658

Authentication Bypass Java

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 04:50 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 19, 2026 - 23:00 euvd

EUVD-2026-13345

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:36 nvd

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

724 maven packages depend on org.springframework.boot:spring-boot-starter-actuator (548 direct, 176 indirect)

Ecosystem-wide dependent count for version 3.4.0.

DescriptionCVE.org

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

AnalysisAI

Spring Boot Actuator endpoints can be bypassed for authentication when application endpoints are configured under Health Group paths in versions 4.0 before 4.0.3, 3.5 before 3.5.11, and 3.4 before 3.4.15. An unauthenticated attacker can exploit this path-based misconfiguration to gain unauthorized access to protected resources with high confidence in authentication bypass and partial information disclosure. No patch is currently available.

Technical ContextAI

Spring Boot is a popular Java-based framework for building microservices and web applications, with Actuator being a production-ready feature that provides monitoring and management capabilities through HTTP endpoints. The vulnerability stems from improper authentication enforcement (CWE-288) where the framework fails to correctly apply authentication requirements to endpoints that fall under Health Group additional path configurations. According to the CPE data (cpe:2.3:a:spring:spring_boot:*:*:*:*:*:*:*:*), this affects the core Spring Boot framework across multiple major version branches, making it a widespread issue in the Java ecosystem.

RemediationAI

Upgrade Spring Boot to patched versions 4.0.3 or later, 3.5.11 or later, or 3.4.15 or later depending on your current major version branch, as detailed in the Spring security advisory at https://spring.io/security/cve-2026-22731. As an immediate mitigation, review all Actuator endpoint configurations to ensure authentication is properly enforced at the web server or API gateway level for any endpoints under Health Group additional paths, and consider temporarily disabling or restricting access to Actuator endpoints if immediate patching is not feasible.