CVE-2026-22732

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.49%
EPSS Percentile: 42.10%
CISA KEV: Not listed

Description

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers: : from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 20-Mar-2026 06:16
Last Modified: 17-Jun-2026 17:20
EPSS Date: 2026-10-30
CWE: CWE-425

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

Affected Products / Versions

vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 5.7.22
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.8.0 · before (exclusive) 5.8.24
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.3.0 · before (exclusive) 6.3.15
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.4.0 · before (exclusive) 6.4.15
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.5.0 · before (exclusive) 6.5.9
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
vmware / spring_security Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.0.0 · before (exclusive) 7.0.4
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 31-Oct-2026 18:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (5)

CVE-2026-22732 (CVSS score: 9.1) – Potential Spring security vulnerability within SAP Commerce Cloud and SAP Data Hub Fortinet, Ivanti and SAP Patch Critical Vulnerabilities Across Multiple Products
CVE-2026-22732 (CVSS 9.1) – Spring Security-related vulnerability affecting SAP Commerce Cloud and SAP Data Hub. SAP Patches Critical NetWeaver and Commerce Cloud Flaws
Affecting Commerce Cloud and Data Hub, the third critical-severity weakness that SAP resolved this week is CVE-2026-22732 (CVSS score of 9.1), which impacts all applications that rely on the Spring Security framework. SAP Patches Four Critical Vulnerabilities in NetWeaver, Commerce and Data Hub
CVE-2026-22732 — Spring Security (Critical, March 2026, CVSS 9.1) Why CVE Feeds and SCA Tools Can Miss End-of-Life Software
CVE-2026-22732 — Spring Security (Critical, March 2026, CVSS 9.1) HeroDevs Warns CVE Feeds Can Miss Vulnerabilities in End-of-Life Packages

CVE (8)

People (1)

Vendors (6)

Products (16)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.