What is the CVSS score of CVE-2026-22752?

CVE-2026-22752 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Spring Authorization Server are affected by CVE-2026-22752?

Spring Authorization Server (versions 7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, and 1.3.0-1.3.10) contains a critical authentication bypass vulnerability allowing low-privileged authenticated users to…

How to fix or mitigate CVE-2026-22752?

Within 24 hours, inventory all systems running affected Spring Authorization Server versions (7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, and 1.3.0-1.3.10) in production and pre-production environments. Within 7 days, implement interim mitigations including network segmentation to restrict authorization service communications, enhanced logging and alerting for authentication attempts and privilege escalations, and enforcement of least-privilege access controls for all service accounts accessing these components. Within 30 days, establish continuous vendor patch monitoring through VMware channels, evaluate migration paths to unaffected versions, conduct pre-production validation, and develop a phased production deployment plan with rollback procedures.

Spring Authorization Server CVE-2026-22752

EUVD-2026-44904 CRITICAL

Improper Authentication (CWE-287)

2026-07-16 vmware

GHSA-h9v6-4cv4-ghhq

Authentication Bypass Java Spring Security Spring Authorization Server

9.6

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

Network-reachable auth bypass needing a low-privilege account (PR:L), no interaction, with a scope change into protected systems yielding high confidentiality/integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:45 vuln.today

CVE Published

Jul 16, 2026 - 08:40 cve.org

CRITICAL 9.6

DescriptionCVE.org

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.

This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.

Articles & Coverage 2

News 6 New Java Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 17, 2026 News Critical Authentication Bypass in Spring Authorization Server - CVE-2026-22752 Jul 16, 2026

AnalysisAI

Authentication bypass in VMware/Spring's Spring Authorization Server (versions 7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, and 1.3.0-1.3.10) allows a low-privileged authenticated actor to circumvent authentication controls and access protected resources across a security boundary. The CVSS 9.6 (Critical) rating reflects a scope change with high confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score in a widely deployed OAuth2/OIDC authorization component makes this a high-priority patch.

Technical ContextAI

Spring Authorization Server is the reference OAuth 2.1 and OpenID Connect 1.0 authorization-server implementation built on the Spring Security framework, used in Java applications to issue and validate access/ID tokens for downstream resource servers. The single affected CPE is cpe:2.3:a:spring_security:spring_authorization_server, spanning both the legacy 1.3.x-1.5.x lines and the modern 7.0.x line. The advisory characterizes the root cause as an 'authentication bypass by primary weakness,' meaning a flaw in the core authentication decision logic itself rather than a secondary configuration error; no CWE was assigned (CWE: N/A), but the class aligns with CWE-287 (Improper Authentication)/CWE-305 (Authentication Bypass by Primary Weakness). Because an authorization server sits at the trust root for token issuance, a bypass here undermines the authentication guarantees relied upon by every client and resource server it protects.

RemediationAI

Patch available per vendor advisory: upgrade Spring Authorization Server to the fixed release for your train as published at https://spring.io/security/cve-2026-22752 - the fixes follow the affected ranges (i.e., the next patch release above 7.0.4, 1.5.6, 1.4.9, and 1.3.10), but exact fixed version numbers are not included in the provided input and should be read directly from that advisory rather than assumed. Prefer moving to the current supported 7.0.x line where feasible, since the 1.3.x-1.5.x branches are older and may have limited future maintenance. If immediate upgrade is impossible, apply compensating controls: restrict network access to the authorization-server endpoints to trusted clients only (front it with a gateway/allowlist), tighten and audit issuance of the low-privilege accounts/clients that satisfy the PR:L precondition, and increase monitoring of token-issuance and authorization flows for anomalous access to protected resources - noting these controls reduce but do not eliminate exposure and may disrupt legitimate clients if the allowlist is too narrow.