Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 3 | Disclosure3 |
| 2026-03-23 | 1 | General1 |
| 2026-03-26 | 1 | Disclosure1 |
| 2026-05-15 | 1 | Disclosure1 |
⚠️ Vulnerabilidades en productos Spring ❗ CVE-2026-22733 ❗ CVE-2026-22732 ❗ CVE-2026-22731 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-spring-2/ https://t.co/p95JH7QS4Y
Post summary
The tweet lists three CVE identifiers for Spring products and links to a website for additional information, but provides no details on exploitation, patches, or technical specifics.
Two high-severity flaws (CVE-2026-22731 & CVE-2026-22733) in Spring Boot Actuators allow authentication bypass. Update your framework today to stay secure. #SpringBoot #CyberSecurity #CVE #InfoSec #AppSec #AuthenticationBypass #Vulnerability #JavaSecurity https://securityonline.info/spring-boot-authentication-bypass-actuator-flaws-cve-2026-22731/ https://t.co/DhnFNBWhk9
Post summary
Two newly disclosed CVEs (CVE‑2026‑22731 & CVE‑2026‑22733) in Spring Boot Actuators allow authentication bypass; the tweet urges users to update their framework to mitigate the risk.
CVE-2026-22733 | VMware Spring Security up to 4.0.3 CloudFoundry Actuator Endpoint authentication bypass (WID-SEC-2026-0799) https://ift.tt/blyqVg3 A vulnerability, which was classified as critical, was found in VMware Spring Security up to 2.7.31/3.3.17/3.4.14/3.5.11/4.0.3. T…
Post summary
A critical authentication bypass vulnerability (CVE-2026-22733) affects VMware Spring Security versions up to 4.0.3, with a link to further details but no indications of active exploitation or remediation.
Learn more 🔗 https://www.herodevs.com/blog-posts/spring-boot-authentication-bypass-two-new-cves-that-enterprise-teams-cannot-afford-to-ignore-cve-2026-22731-cve-2026-22733
Post summary
The text announces the discovery of two new Spring Boot authentication‑bypass CVEs (CVE‑2026‑22731 and CVE‑2026‑22733) and provides a link to a blog post for further details.
Warning: High severity Authentication Bypass flaws in Spring Boot Actuator. #CVE-2026-22731 & #CVE-2026-22733, CVSS: 8.2. Misconfigured endpoint paths can expose protected application endpoints. #Patch #Patch #Patch
Post summary
The post warns of authentication bypass flaws in Spring Boot Actuator, citing CVE-2026-22731 & CVE-2026-22733 with CVSS 8.2, and urges users to apply patches.
CVE-2026-22733 Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is decl… https://www.cve.org/CVERecord?id=CVE-2026-22733
Post summary
The post announces CVE‑2026‑22733 as an authentication‑bypass issue in Spring Boot Actuator, without providing proof of concept, exploit code, patch information, or evidence of active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | spring_boot | - | - | - |