Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2026-22747

HighPublished

Unauthorized User Impersonation when Using X.509 Client Certificates

Published: Apr 22, 2026
Updated: Jul 15, 2026
Assigning CNA: vmware
Evidence observed: Aug 9, 2026

Primary CVSS

8.1/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS probability estimate

0.3%

Low · next 30 days

Percentile: 22.4%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Sources

cve-2026-22747-sandboxResearch
Sandboxed reproduction environment for CVE-2026-22747, enabling controlled testing and analysis of the vulnerability and potential exploits in an isolated Java-based setup.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.