Changeflow GovPing Data Privacy & Cybersecurity Spring Cloud Gateway Vulnerability CVE-2026-22750
Priority review Guidance Added Final

Spring Cloud Gateway Vulnerability CVE-2026-22750

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR issued advisory CERTFR-2026-AVI-0417 regarding CVE-2026-22750, a vulnerability in Spring Cloud Gateway affecting versions 4.2.x prior to 4.2.1. The flaw permits an attacker to exploit an unspecified security issue. French organizations using affected versions should consult the Spring security bulletin for available patches.

View original document View source feed page

What changed

CERT-FR published security advisory CERTFR-2026-AVI-0417 on April 10, 2026, alerting to CVE-2026-22750 affecting Spring Cloud Gateway versions 4.2.x before 4.2.1. The vulnerability allows an attacker to trigger an unspecified security issue. No specific risk severity was disclosed by the vendor.

Organizations running vulnerable versions of Spring Cloud Gateway face potential exploitation risks. Immediate action is required to identify affected deployments and apply the vendor-provided patch. Failure to remediate could expose systems to remote attacks depending on deployment configuration and network exposure.

What to do next

  1. Identify instances of Spring Cloud Gateway 4.2.x in your environment
  2. Apply vendor patch to upgrade to version 4.2.1 or later
  3. Monitor vendor advisories for additional mitigation guidance

Archived snapshot

Apr 10, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 10 avril 2026 N° CERTFR-2026-AVI-0417 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Spring Cloud Gateway

Gestion du document

| Référence | CERTFR-2026-AVI-0417 |
| Titre | Vulnérabilité dans Spring Cloud Gateway |
| Date de la première version | 10 avril 2026 |
| Date de la dernière version | 10 avril 2026 |
| Source(s) | Bulletin de sécurité Spring cve-2026-22750 du 09 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Non spécifié par l'éditeur

Systèmes affectés

  • Cloud Gateway versions 4.2.x antérieures à 4.2.1

Résumé

Une vulnérabilité a été découverte dans Spring Cloud Gateway. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 10 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Foxit PDF Services API SSRF Vulnerability Advisory
Priority review Apr 13, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Critical Adobe Acrobat Vulnerability CVE-2026-34621 Actively Exploited
Urgent Apr 13, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach
Priority review Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 10th, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0417

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability remediation Software patching System security
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 292 Consumer Protection 46 Courts & Legal 361 Data Privacy & Cybersecurity 76 Defense & National Security 51 Education 22 Energy 100 Environment 86 Environmental & Energy 11 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Government Operations 4 Healthcare 136 Healthcare & Life Sciences 3 Housing 16 Immigration 8 Immigration & Border Control 1 Insurance 58 Labor & Employment 114 Legal & Judicial 8 Pharma & Drug Safety 104 Public Health 2 Real Estate & Housing 3 Sanctions & Export Controls 1 Securities & Markets 103 Securities Regulation 6 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Commerce 2 Trade & Sanctions 135 Transportation 60

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!