CVE-2025-41243
Published: 16 September 2025
Summary
CVE-2025-41243 is a critical-severity Code Injection (CWE-94) vulnerability in Spring Cloud Gateway (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-7 (Least Functionality).
Deeper analysis
Spring Cloud Gateway Server Webflux is vulnerable to unauthorized modification of Spring Environment properties when the application also includes Spring Boot actuator as a dependency, exposes the gateway actuator endpoint via management.endpoints.web.exposure.include=gateway, and leaves those actuator endpoints both reachable and unsecured over the network. Spring Cloud Gateway Server WebMVC is explicitly not affected. The issue carries a CVSS 3.1 score of 10.0 and is associated with CWE-94 and CWE-917.
An unauthenticated attacker with network access to the exposed actuator endpoints can alter Environment properties, enabling remote code execution or other high-impact changes to confidentiality, integrity, and availability with scope change. The attack requires no user interaction and can be carried out directly against any instance meeting the listed preconditions.
The Spring security advisory at https://spring.io/security/cve-2025-41243 addresses mitigation steps for the affected component. Exploitation probability remains low, with an EPSS score of 0.0642 and a recorded peak of 0.0812.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29611
Vulnerability details
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC…
more
is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of an exposed public-facing Spring actuator endpoint enabling code injection and arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on unsecured actuator endpoints, directly preventing unauthorized remote access for Spring Environment property modification.
Restricts system to least functionality by disabling unnecessary gateway actuator endpoints, eliminating the vulnerable configuration property exposure.
Monitors and controls network access to internal actuator endpoints, blocking availability to external attackers required for exploitation.