Critical Spring Security Vulnerabilities Fixed, Authentication Bypass Risk
Summary
CSIRT-ITA issued an alert (AL05/260422/CSIRT-ITA) reporting that security updates have resolved new vulnerabilities in Spring Security and Spring Authorization Server, including one classified as "critical" severity and two classified as "high" severity. The affected products include Spring Security versions 7.0.4 and earlier, and Spring Authorization Server versions 1.3.10, 1.4.9, 1.5.6 and earlier. Three CVEs are referenced: CVE-2026-22752, CVE-2026-22753, and CVE-2026-22754. The alert recommends updating vulnerable products to patched versions following the vendor security bulletins published at spring.io/security.
“Aggiornamenti di sicurezza risolvono nuove vulnerabilità, tra cui una con gravità "critica" e due "alta", in Spring, noto framework open‑source per lo sviluppo di applicazioni Java, usato in ambito enterprise.”
Organizations running Spring Security or Spring Authorization Server should inventory their Java application dependencies to determine if any affected versions (7.0.4 and earlier for Security; 1.3.10, 1.4.9, 1.5.6 and earlier for Authorization Server) are in use. Given the Authentication Bypass and Privilege Escalation classifications, prioritizing patches for internet-facing applications is warranted even without confirmed active exploitation.
About this source
GovPing monitors Italy CSIRT Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 3 changes logged to date.
What changed
CSIRT-ITA published an alert notifying that Spring Security and Spring Authorization Server contain resolved security vulnerabilities classified as critical and high severity. The affected versions include Spring Security 7.x.x up to 7.0.4, and Spring Authorization Server 1.3.x up to 1.3.10, 1.4.x up to 1.4.9, and 1.5.x up to 1.5.6. The alert lists three CVEs (CVE-2026-22752, CVE-2026-22753, CVE-2026-22754) and classifies the vulnerabilities as Authentication Bypass, Privilege Escalation, and Security Feature Bypass.
Organizations using Spring Security or Spring Authorization Server in enterprise Java applications should identify which versions are deployed in their environments and apply the vendor-recommended updates. No PoC or exploitation indicators were reported at the time of publication. System impact is rated as High (66.15).
What to do next
- Update vulnerable Spring products to patched versions following vendor security bulletins at spring.io/security
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Risolte vulnerabilità in Spring
**
Alert**
AL05/260422/CSIRT-ITA
Condividi
- Facebook
- Twitter
- LinkedIn
- Whatsapp
Sintesi
Aggiornamenti di sicurezza risolvono nuove vulnerabilità, tra cui una con gravità “critica” e due “alta”, in Spring, noto framework open‑source per lo sviluppo di applicazioni Java, usato in ambito enterprise.
Tipologia
- Authentication Bypass
- Privilege Escalation
- Security Feature Bypass
Prodotti e/o versioni affette
Spring Security
7.x.x, versione 7.0.4 e precedenti
Spring Authorization Server1.3.x, versione 1.3.10 e precedenti
1.4.x, versione 1.4.9 e precedenti
1.5.x, versione 1.5.6 e precedenti
Azioni di mitigazione
In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.
Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”:
CVE (3)
Cerca:
| CVE | POC | EXPLOITATION |
| --- | --- | --- |
| CVE‑2026‑22752 | - | - |
| CVE‑2026‑22753 | - | - |
| CVE‑2026‑22754 | - | - |
Riferimenti (4)
- https://spring.io/security/cve-2026-22752
- https://spring.io/security/cve-2026-22753
- https://spring.io/security/cve-2026-22754
- https://spring.io/security
Change log
| Versione | Note | Data |
|---|---|---|
| 1.0 | Pubblicato il 22-04-2026 | 22/04/2026 |
Impatto sistemico
Alto (66.15)
Argomenti
Data pubblicazione
22/04/26 ore 15:01
Data Ultimo Aggiornamento
22/04/26 ore 15:01
Related changes
Get daily alerts for Italy CSIRT Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSIRT-ITA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Italy CSIRT Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.