Is there a public PoC exploit available for CVE-2026-62242?

Yes, a public proof-of-concept exploit is available for CVE-2026-62242. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-62242?

Within 24 hours, identify all instances of Spring Boot Admin Server in your environment and their current versions. Within 7 days, upgrade all instances to version 4.1.2 or later; this is the vendor-released patch addressing this vulnerability. Within 30 days, conduct a security audit to verify no unauthorized access occurred to exposed metadata endpoints and rotate any credentials that may have been exposed through this service.

Java CVE-2026-62242

Q: What is the CVSS score of CVE-2026-62242?

CVE-2026-62242 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

Q: Which versions of Java are affected by CVE-2026-62242?

Spring Boot Admin Server versions prior to 4.1.2 contain a server-side request forgery vulnerability that allows unauthenticated attackers to bypass network segmentation and extract sensitive cloud…. A patch is available.

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-13 VulnCheck

Java SSRF Spring Boot Admin Codecentric

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 21:46 vuln.today

Analysis Generated

Jul 13, 2026 - 21:46 vuln.today

CVE Published

Jul 13, 2026 - 21:04 cve.org

HIGH 7.7

DescriptionCVE.org

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via the actuator proxy to exfiltrate cloud credentials.

Articles & Coverage 1

News 3 New Java Vulnerabilities - 1 Critical, 2 High, 1 With POC Jul 14, 2026

AnalysisAI

Server-side request forgery in codecentric Spring Boot Admin Server before 4.1.2 lets unauthenticated remote attackers register a monitored instance with attacker-controlled healthUrl and managementUrl values that are never validated against private IP ranges or cloud metadata endpoints. Because the server then fetches those URLs and exposes the response bodies through its actuator proxy, an attacker can pivot into internal networks and read back sensitive data such as cloud instance-metadata credentials. Publicly available exploit code exists and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV).