What is the CVSS score of CVE-2026-22747?

CVE-2026-22747 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-22747?

Spring Security versions 7.0.0-7.0.4 contain a critical authentication bypass vulnerability affecting certificate-based authentication systems.. A patch is available.

How to fix or mitigate CVE-2026-22747?

Within 24 hours: Audit all systems running Spring Security 7.0.0-7.0.4 with X.509 certificate authentication enabled and document asset inventory. Within 7 days: Apply Spring Security patch (confirm specific version from vendor advisory) and redeploy affected applications. Within 30 days: Verify patch deployment across all systems; implement certificate validation logging and anomaly detection for suspicious impersonation attempts.

Java CVE-2026-22747

EUVD-2026-24609 HIGH

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-04-22 vmware

GHSA-2jrg-rf5x-568g

Information Disclosure Java Spring Security

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-reachable X.509 auth (AV:N); crafting a malformed-CN cert accepted by trust chain raises complexity (AC:H); attacker needs a usable certificate (PR:L); impersonation yields C:H/I:H, no availability impact (A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 04:33 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:32 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:32 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 04:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 03:24 NVD

6.8 (MEDIUM) 8.1 (HIGH)

Analysis Generated

Apr 22, 2026 - 06:30 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 06:00 euvd

EUVD-2026-24609

Analysis Generated

Apr 22, 2026 - 06:00 vuln.today

CVE Published

Apr 22, 2026 - 05:08 nvd

MEDIUM 6.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

179 maven packages depend on org.springframework.security:spring-security-web (25 direct, 154 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

AnalysisAI

Authentication bypass via user impersonation affects Spring Security 7.0.0 through 7.0.4, where the SubjectX500PrincipalExtractor mishandles malformed CN values in X.509 client certificates and extracts the wrong username. Authenticated attackers presenting a carefully crafted certificate can be authenticated as a different (potentially higher-privileged) user. No public exploit identified at time of analysis; EPSS is very low (0.02%) and CISA SSVC marks exploitation as none.