CVE-2025-41243
CRITICAL EPSS 87.0%
Published Sep 16, 20259mo ago · Modified Jun 17, 20262w ago
10.0 CVSS 3.1
Published Sep 16, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago
Description
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
87.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-917
CWE-94 Improper Control of Generation of Code (Code Injection) Injection
References 1
- spring.io https://spring.io/security/cve-2025-41243
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.