VMware Tanzu flaws being used in attacks

CISA lists 3 flaws in VMware Tanzu products as being used in attacks, most recently on 25 Aug 2022. 1 has been used in ransomware.

What to do

1. Update every VMware Tanzu product you use.Install the updates VMware Tanzu offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 25 Aug 2022
   VMware Tanzu Spring Cloud
   CVE-2022-22963VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
   When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 25 Mar 2022
   VMware Tanzu Spring Cloud Configuration (Config) Server
   CVE-2020-5410VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
   Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability that allows applications to serve arbitrary configuration files.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
3. Being used in attacksUsed in ransomwareAdded by CISA on 25 Mar 2022
   VMware Tanzu Spring Data Commons
   CVE-2018-1273VMware Tanzu Spring Data Commons Property Binder Vulnerability
   Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. VMware Tanzu on CISA’s site.