What is the CVSS score of CVE-2026-22750?

CVE-2026-22750 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-22750?

Within 24 hours: Audit all Spring Cloud Gateway 4.2.0 deployments and document current SSL bundle configurations and traffic sensitivity. Within 7 days: Apply temporary mitigation by implementing network-level TLS inspection and strict certificate pinning at the gateway perimeter; evaluate upgrade to Spring Cloud Gateway 4.1.x or earlier stable release. Within 30 days: Complete migration away from 4.2.0 or apply vendor-released patch once available; validate SSL configuration enforcement through traffic analysis.

Spring Cloud Gateway CVE-2026-22750

Q: Which versions of Spring Cloud Gateway are affected by CVE-2026-22750?

VMware Spring Cloud Gateway 4.2.0 contains a critical SSL configuration bypass that forces systems to fall back to insecure defaults, exposing encrypted communications to man-in-the-middle attacks…. A patch is available.

EUVD-2026-21330 HIGH

External Control of System or Configuration Setting (CWE-15)

2026-04-10 vmware

GHSA-hwqh-2684-54fc

Java Information Disclosure VMware Spring Cloud Gateway

7.5

CVSS 3.1 · Vendor: vmware

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Configure SSL bundle via spring.ssl.bundle property
Exploit

Configuration silently ignored by gateway
Execution

Default SSL settings applied instead
Impact

Attacker intercepts unencrypted or weakly encrypted traffic

Vulnerability Assessment

Weakness	CWE CWE-15 OWASP Top 10:2025 A02:2025 - Security Misconfiguration ASVS 5.0 V13 - Configuration Configuration hardening
Exploitation Conditions	Spring Cloud Gateway 4.2.0 with spring.ssl.bundle configuration property set. Remote unauthenticated attacker can exploit default SSL configuration bypass. No user interaction required. Affects non-enterprise deployments using affected versions.
Impact	High-severity integrity impact (CVSS 7.5) via unauthenticated network attack. SSL bundle configuration silently ignored, forcing use of default SSL settings that may lack organizational security requirements (custom certs, cipher suites). Affects Spring Cloud Gateway versions before 4.2.1, 5.0.2, 5.1.1. Low observed exploitation activity. Priority depends on whether custom SSL bundles enforce compliance or threat model.
Exploit ScenarioDerived	Attacker performs man-in-the-middle interception on Spring Cloud Gateway traffic. Gateway ignores configured spring.ssl.bundle property due to silent configuration failure, accepting attacker's certificate via permissive default SSL settings instead of strict custom bundle policies.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

SSL bundle configuration bypass in VMware Spring Cloud Gateway 4.2.0 allows unaneticated remote attackers to compromise integrity through forced fallback to default SSL settings. When administrators configure custom SSL bundles via spring.ssl.bundle property, the framework silently ignores this configuration and applies insecure defaults instead, enabling man-in-the-middle attacks against intended encrypted communications. Affects Spring Cloud Gateway 4.2.0 with no public exploit identified at time of analysis.

RemediationAI

Vendor-released patches: upgrade to Spring Cloud Gateway 5.0.2 or 5.1.1 for actively supported open source releases, or to any 4.2.x version newer than 4.2.0 available via Maven Central at https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ for non-enterprise users on legacy 4.2.x branch. Official advisory at https://spring.io/security/cve-2026-22750 provides detailed upgrade guidance. Enterprise customers on 4.2.x should consult VMware support channels for patched builds. Post-upgrade, validate SSL bundle configurations are actively applied by inspecting runtime TLS handshake parameters and certificate chains to confirm custom trust stores took effect.

Affected VersionsENISA

Spring cloud Gateway 4.2.0 <4.2.1

Affected Packages

maven org.springframework.cloud:spring-cloud-gateway fix: 4.2.1

euvd spring_cloud_gateway fix: 4.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Configuration parsing failure in Spring Cloud Gateway's SSL bundle initialization logic causes silent fallback to default trust stores and cipher suites when spring.ssl.bundle property is set. The CPE cpe:2.3:a:vmware:spring_cloud_gateway identifies the vulnerable component. This represents a configuration validation gap rather than traditional input validation vulnerability, allowing weaker-than-intended cryptographic controls.

Know when Spring Cloud Gateway gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vmware) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 10, 2026 - 07:32 nvd

HIGH 7.5

DescriptionCVE.org

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

Executive ViewAI

Why It Matters

VMware Spring Cloud Gateway 4.2.0 contains a critical SSL configuration bypass that forces systems to fall back to insecure defaults, exposing encrypted communications to man-in-the-middle attacks regardless of administrator intent. Organizations running this version are at immediate risk of data interception and integrity compromise on all gateway-mediated traffic, with no vendor patch currently available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement mutual TLS (mTLS) enforcement at network boundaries upstream of affected gateways; (2) Deploy external TLS termination with certificate pinning to trusted Certificate Authorities only; (3) Restrict gateway traffic to isolated network segments with enhanced monitoring; (4) Downgrade to Spring Cloud Gateway 4.1.x or earlier confirmed unaffected version; (5) Enable detailed TLS negotiation logging to detect unexpected fallback behavior.

Threat Intelligence Overview

EPSS Score

0.0%

Top 90% exploitable

Threat Intel

1 source

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.