What is the CVSS score of CVE-2026-22750?

CVE-2026-22750 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by CVE-2026-22750?

VMware Spring Cloud Gateway 4.2.0 contains a critical SSL configuration bypass that forces systems to fall back to insecure defaults, exposing encrypted communications to man-in-the-middle attacks…. A patch is available.

How to fix or mitigate CVE-2026-22750?

Within 24 hours: Audit all Spring Cloud Gateway 4.2.0 deployments and document current SSL bundle configurations and traffic sensitivity. Within 7 days: Apply temporary mitigation by implementing network-level TLS inspection and strict certificate pinning at the gateway perimeter; evaluate upgrade to Spring Cloud Gateway 4.1.x or earlier stable release. Within 30 days: Complete migration away from 4.2.0 or apply vendor-released patch once available; validate SSL configuration enforcement through traffic analysis.

Java CVE-2026-22750

EUVD-2026-21330 HIGH

External Control of System or Configuration Setting (CWE-15)

2026-04-10 vmware

GHSA-hwqh-2684-54fc

Information Disclosure Java

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 10, 2026 - 08:15 euvd

EUVD-2026-21330

Analysis Generated

Apr 10, 2026 - 08:15 vuln.today

CVE Published

Apr 10, 2026 - 07:32 nvd

HIGH 7.5

DescriptionCVE.org

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

AnalysisAI

SSL bundle configuration bypass in VMware Spring Cloud Gateway 4.2.0 allows unaneticated remote attackers to compromise integrity through forced fallback to default SSL settings. When administrators configure custom SSL bundles via spring.ssl.bundle property, the framework silently ignores this configuration and applies insecure defaults instead, enabling man-in-the-middle attacks against intended encrypted communications. Affects Spring Cloud Gateway 4.2.0 with no public exploit identified at time of analysis.

Technical ContextAI

Configuration parsing failure in Spring Cloud Gateway's SSL bundle initialization logic causes silent fallback to default trust stores and cipher suites when spring.ssl.bundle property is set. The CPE cpe:2.3:a:vmware:spring_cloud_gateway identifies the vulnerable component. This represents a configuration validation gap rather than traditional input validation vulnerability, allowing weaker-than-intended cryptographic controls.

RemediationAI

Vendor-released patches: upgrade to Spring Cloud Gateway 5.0.2 or 5.1.1 for actively supported open source releases, or to any 4.2.x version newer than 4.2.0 available via Maven Central at https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ for non-enterprise users on legacy 4.2.x branch. Official advisory at https://spring.io/security/cve-2026-22750 provides detailed upgrade guidance. Enterprise customers on 4.2.x should consult VMware support channels for patched builds. Post-upgrade, validate SSL bundle configurations are actively applied by inspecting runtime TLS handshake parameters and certificate chains to confirm custom trust stores took effect.