PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-22947 VMware CVE debrief

CVE-2022-22947 is a VMware Spring Cloud Gateway code injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2022-05-16. Because it is listed in KEV, defenders should treat it as actively exploited and prioritize remediation using vendor guidance.

Vendor
VMware
Product
Spring Cloud Gateway
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-05-16
Original CVE updated
2022-05-16
Advisory published
2022-05-16
Advisory updated
2022-05-16

Who should care

Organizations and security teams responsible for VMware Spring Cloud Gateway deployments should prioritize this CVE, especially teams handling patching, vulnerability management, and asset inventory.

Technical summary

The official source corpus identifies CVE-2022-22947 as a code injection vulnerability in VMware Spring Cloud Gateway. CISA’s KEV catalog marks it as known exploited and directs organizations to apply updates per vendor instructions. The source set does not provide a CVSS score or additional technical detail.

Defensive priority

High. CISA’s KEV inclusion indicates known exploitation, so remediation should be prioritized over routine patch cycles.

Recommended defensive actions

  • Identify all VMware Spring Cloud Gateway instances in your environment.
  • Apply vendor-provided updates or mitigations as directed in official VMware guidance.
  • Verify whether any affected systems were exposed before patching and review them for unexpected changes.
  • Confirm the vulnerability is removed from your exposure and remediation tracking.
  • Monitor CISA KEV updates and vendor advisories for any follow-on guidance.

Evidence notes

This debrief is based only on the supplied official records: the CISA Known Exploited Vulnerabilities entry, the CVE record, and the NVD detail link. The corpus confirms the vulnerability name, product, known-exploitation status, and KEV dates (added 2022-05-16; due 2022-06-06). No CVSS score was provided in the source corpus, so none is stated here.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-22947 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-22947

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-22947 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-22947

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.first.org/epss/

    first_epss

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.