CVE-2026-22747 — Spring Security: From Vulnerability
CVE-2026-22747 — Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating
What This Means For You
- If your environment is affected by this vulnerability type, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-22747 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-22747 - Spring Security X.509 CN Impersonation Attempt
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-22747 | vulnerability | CVE-2026-22747 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 22, 2026 at 09:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related Posts
Telerik UI for AJAX RadFilter Vulnerable to RCE via Deserialization
CVE-2026-6023 — In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if...
Telerik UI Vulnerability Allows Disk Space Exhaustion Attacks
CVE-2026-6022 — In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the...
Microsoft Rushes Patches for Critical ASP.NET Core Privilege Escalation Flaw
Microsoft has issued out-of-band updates to address a critical privilege escalation vulnerability (CVE-2026-40372) in ASP.NET Core's Data Protection APIs. BleepingComputer reports that unauthenticated attackers could...