Loading story…
Two critical vulnerabilities in the Spring ecosystem exposed Java applications to remote code execution: CVE-2022-22965 in the Spring Framework, widely known as Spring4Shell, and CVE-2022-22963 in Spring Cloud Function. Spring4Shell abuses the framework’s data-binding mechanism under specific conditions—including JDK 9+, Apache Tomcat, vulnerable Spring Framework versions, and WAR deployment—to let attackers overwrite Tomcat logging configuration and drop a JSP web shell on the server.
The Spring Cloud Function issue, CVE-2022-22963, allows code injection through a crafted spring.cloud.function.routing-expression HTTP header that exploits Spring Expression Language (SpEL) to achieve remote code execution. Vendor and security reporting identified affected versions, published fixes and mitigations, and highlighted detection opportunities including exploit-related file hashes and generic security verdicts for spotting attempted compromise.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Securelist published technical analysis of CVE-2022-22965 (Spring4Shell) and CVE-2022-22963, describing exploitation conditions, affected versions, available fixes, and detection indicators including exploit-related MD5 hashes.
VMware published an advisory for CVE-2022-22963, a remote code execution flaw in Spring Cloud Function caused by malicious Spring Expression handling in routing functionality.
Wiz reported that approximately 63% of cloud environments in its dataset contained resources affected by CVE-2022-22965 (Spring4Shell); roughly 75% of those resources were virtual machines and 25% were containers. It assessed known public exploitation as constrained by deployment prerequisites, with no publicly identified real-world targets meeting all known conditions apart from research demonstrations.
Praetorian reported that Spring Core deployments running on JDK 9 or later were vulnerable to remote code execution, the issue commonly known as Spring4Shell (CVE-2022-22965).
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcewiz.io
Open sourcepraetorian.com
Open sourcetanzu.vmware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed vulnerability dubbed **Spring4Shell** or **SpringShell** affects certain Spring-based Java applications and could allow remote code execution under specific conditions. Reported prerequisites include use of the `spring-beans` library, **Java 9+**, and **Tomcat 9+**; successful exploitation may let an attacker write a malicious payload to disk for later execution. Public proof-of-concept code was released, increasing the risk of opportunistic testing against exposed systems. The reporting distinguishes Spring4Shell from **`CVE-2022-22963`**, which affects **Spring Cloud Function** and is described as a separate issue rather than the same flaw. At the time covered by the references, there were no official reports of active exploitation in the wild and no official patch yet available, but defenders were provided public mitigation guidance and **YARA** detection rules to help identify vulnerable deployments and possible exploitation attempts.
Jul 16, 2026
Attackers began exploiting the Spring Framework remote code execution flaw **Spring4Shell** (`CVE-2022-22965`) to plant JSP web shells on vulnerable Apache Tomcat servers and deliver cryptocurrency miners. Trend Micro reported attempts that wrote a web shell named `zbc0fb.jsp` into the Tomcat web root, then used it to run operating-system-specific payloads on both Windows and Linux systems. The activity followed Spring's disclosure of the RCE issue and its guidance to upgrade to fixed releases, including **Spring Framework 5.3.18** and **5.2.20** or later. On Windows targets, the observed chain used hidden PowerShell execution to fetch `ldr.ps1` in memory, which then downloaded a miner from `194.145.227.21`. The miner was designed to disable the firewall, kill competing miner processes and services bound to common mining ports, launch the payload, and establish persistence through a scheduled task named **BrowserUpdate** and a Windows Run key. The intrusion pattern mirrors earlier enterprise-server exploitation seen in incidents such as **WebLogic RCE leading to XMRig**, underscoring how rapidly newly disclosed Java server flaws are weaponized for opportunistic cryptomining.
Aug 26, 2026
Attackers exploited the **Spring4Shell** remote code execution flaw, tracked as `CVE-2022-22965`, to gain code execution on vulnerable Spring Framework applications and deploy **Mirai** botnet malware. Reporting from Trend Micro showed the vulnerability being weaponized shortly after disclosure, with exploitation attempts targeting exposed Java applications that met the conditions for the flaw. The observed activity linked a high-profile enterprise software vulnerability to commodity botnet operations, demonstrating how internet-facing servers can be rapidly folded into malware infrastructure after public disclosure. In the documented attacks, successful exploitation led to execution of Mirai-related payloads on compromised systems, underscoring the risk of unpatched Spring deployments being used for botnet propagation and follow-on malicious activity.
Aug 14, 2026