What is the CVSS score of CVE-2026-22738?

CVE-2026-22738 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Java are affected by CVE-2026-22738?

Spring AI versions 1.0.0-1.0.4 and 1.1.0-1.1.3 contain a critical remote code execution vulnerability in the SimpleVectorStore component that allows unauthenticated attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-22738?

Within 24 hours: Identify all applications using Spring AI 1.0.0-1.0.4 or 1.1.0-1.1.3 and assess whether SimpleVectorStore processes untrusted user input in filter expressions. Within 7 days: Implement network segmentation and input validation controls (see compensating controls); disable SimpleVectorStore if not operationally critical. Within 30 days: Monitor vendor advisories for patched versions and prepare upgrade testing; upgrade to patched Spring AI release immediately upon availability.

Java CVE-2026-22738

EUVD-2026-16535 CRITICAL

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-03-27 vmware

GHSA-fvh3-672c-7p6c

Java RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 20:22 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 05:30 euvd

EUVD-2026-16535

Analysis Generated

Mar 27, 2026 - 05:30 vuln.today

CVE Published

Mar 27, 2026 - 05:21 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

163 maven packages depend on org.springframework.ai:spring-ai-vector-store (36 direct, 127 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Articles & Coverage 1

medium.com CVE-2026-22738: Unauthenticated RCE via SpEL Injection in Spring AI SimpleVectorStore

AnalysisAI

Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Spring Expression Language (SpEL) injection in the SimpleVectorStore component when user-supplied input is incorporated into filter expression keys. This critical vulnerability (CVSS 9.8) enables attackers to execute arbitrary code without authentication on applications using SimpleVectorStore with untrusted filter input. No public exploit identified at time of analysis, though the attack complexity is low and requires no user interaction according to the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Technical ContextAI

Spring AI is VMware's framework for building AI-powered applications with large language models. The vulnerability stems from unsafe handling of Spring Expression Language (SpEL) expressions within the SimpleVectorStore component, which is used for vector similarity search operations. According to the CPE identifier cpe:2.3:a:spring:spring_ai, the affected product is Spring AI from the Spring ecosystem. SpEL injection occurs when user-controlled data is evaluated as executable SpEL expressions without proper sanitization, allowing attackers to break out of intended expression contexts and execute arbitrary Java code on the server. This vulnerability specifically manifests when applications accept user-supplied values as filter expression keys in SimpleVectorStore operations, treating untrusted input as executable code rather than inert data.

RemediationAI

Upgrade Spring AI to version 1.0.5 or later for the 1.0.x series, or version 1.1.4 or later for the 1.1.x series as documented in the vendor security advisory at https://spring.io/security/cve-2026-22738. These versions contain patches that prevent SpEL injection in SimpleVectorStore filter expressions. Until patching is completed, implement immediate compensating controls by validating and sanitizing all user-supplied input before using it as filter expression keys, preferably using an allowlist of permitted values rather than attempting to block malicious patterns. If feasible, refactor applications to avoid passing user-controlled data directly to SimpleVectorStore filter expressions, instead using parameterized queries or safe data structures that do not evaluate expressions. Review application architecture to identify all code paths where external input flows into SimpleVectorStore operations.