What is the CVSS score of CVE-2026-22733?

CVE-2026-22733 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-22733?

Spring Boot applications using Actuator endpoints are vulnerable to authentication bypass attacks that could allow unauthorized access to sensitive application functionality and data.. A patch is available.

How to fix or mitigate CVE-2026-22733?

Within 24 hours: Inventory all Spring Boot applications using Actuator and identify those running vulnerable Spring Security versions (2.7.0-2.7.31, 3.3.0-3.3.17, 3.4.0-3.4.14, 3.5.0-3.5.11, 4.0.0-4.0.3). Within 7 days: Implement compensating controls listed below and apply Web Application Firewall rules to block suspicious Actuator access patterns. Within 30 days: Upgrade to patched Spring Security versions when available, or migrate to alternative authentication mechanisms that do not expose Actuator endpoints under protected paths.

Java CVE-2026-22733

EUVD-2026-13349 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-20 security@vmware.com

GHSA-mgvc-8q2h-5pgc

Authentication Bypass Java

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 14:37 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 00:30 euvd

EUVD-2026-13349

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 maven packages depend on org.springframework.boot:spring-boot-starter-actuator (12 direct, 2 indirect)

Ecosystem-wide dependent count for version 4.0.0-M1.

DescriptionCVE.org

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

AnalysisAI

This is an authentication bypass vulnerability in Spring Boot applications using Spring Security with Actuator endpoints. When an authenticated application endpoint is declared under the CloudFoundry Actuator path, attackers can bypass authentication requirements and gain unauthorized access to protected resources. The vulnerability affects multiple versions of Spring Security from 2.7.0 through 4.0.3 and carries a high CVSS score of 8.2, though no active exploitation or proof-of-concept has been reported.

Technical ContextAI

Spring Boot Actuator provides production-ready features like health checks and metrics endpoints, while CloudFoundry integration adds specific management endpoints for cloud deployments. The vulnerability stems from improper authentication enforcement (CWE-288) when custom application endpoints are mapped under the CloudFoundry Actuator base path. Spring Security's authentication filters fail to properly protect these endpoints due to path matching conflicts between the CloudFoundry Actuator configuration and custom endpoint mappings. This affects Spring Boot applications that use both Spring Security and Spring Boot Actuator with CloudFoundry integration enabled.

RemediationAI

Upgrade Spring Security to versions newer than 4.0.3 for the 4.x branch, 3.5.11 for the 3.5.x branch, 3.4.14 for the 3.4.x branch, 3.3.17 for the 3.3.x branch, or 2.7.31 for the 2.7.x branch as recommended in the vendor advisory at https://spring.io/security/cve-2026-22733. As an immediate workaround, ensure that no authenticated application endpoints are mapped under the CloudFoundry Actuator base path, typically '/cloudfoundryapplication'. Review all endpoint mappings in your Spring Boot configuration and relocate any custom authenticated endpoints to paths outside the Actuator namespace.