VulnerabilityModified

CVE-2026-22747

Vulnerability in Spring Spring Security.

HIGH 8.1EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-297, CWE-295
Affected: vmware/spring security
Source: security@vmware.com

References

https://spring.io/security/cve-2026-22747Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-22747
https://bugzilla.redhat.com/show_bug.cgi?id=2460487
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22747.json

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.