Cyber Posture

CVE-2026-22865

High

Published: 16 January 2026

Published
16 January 2026
Modified
18 February 2026
KEV Added
Patch
CVSS Score 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0002 7.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22865 is a high-severity Download of Code Without Integrity Check (CWE-494) vulnerability in Gradle Gradle. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Software Dependencies and Development Tools (T1195.001); ranked at the 7.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Compromise Software Dependencies and Development Tools (T1195.001).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-829 CWE-494

Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.

addresses: CWE-829 CWE-494

Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.

addresses: CWE-494 CWE-829

Supply chain protection requires integrity verification of acquired components, directly reducing insertion or tampering of malicious code during delivery.

addresses: CWE-829 CWE-494

Limits inclusion of functionality from untrusted sources through supply-chain and component trustworthiness evaluation before integration.

addresses: CWE-494 CWE-829

Component authenticity requires verifying origin/integrity of acquired firmware or software, directly preventing inclusion of code without integrity checks.

addresses: CWE-829 CWE-494

Allocation of supply-chain risk management responsibilities and vetting of the development/operational environment reduce inclusion of functionality from untrusted control spheres.

addresses: CWE-494 CWE-829

Authorizing and controlling mobile code requires verifying origin and integrity before download/execution, directly preventing this weakness.

addresses: CWE-494 CWE-829

Proactive network scanning for malicious code directly detects and blocks downloads that lack integrity verification.

MITRE ATT&CK Enterprise TechniquesAI

T1195.001 Compromise Software Dependencies and Development Tools Initial Access
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise.
Why these techniques?

Vulnerability directly enables compromise of software dependencies by forcing fallback to attacker-controlled repository during Gradle resolution, matching T1195.001.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled.…

more

If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next repository. This behavior could allow an attacker to disrupt the service of a repository and leverage another repository to serve malicious artifacts. This attack requires the attacker to have control over a repository after the disrupted repository. Gradle has introduced a change in behavior in Gradle 9.3.0 to stop searching other repositories when encountering these errors.

Deeper analysisAI

CVE-2026-22865 affects Gradle, a build automation tool, specifically its dependency resolution process in versions prior to 9.3.0. The native-platform tool in Gradle provides Java bindings for native APIs, but the vulnerability stems from how Gradle handles certain exceptions during repository access. Exceptions such as NoHttpResponseException were not treated as fatal errors, preventing the disablement of the affected repository. Instead, Gradle would proceed to the next repository in the list after retries, potentially resolving dependencies from an alternative source.

An attacker can exploit this vulnerability by disrupting service on a targeted repository—such as through persistent transient errors like NoHttpResponseException—to force Gradle to fall back to a subsequent repository under the attacker's control. This enables the serving of malicious artifacts during dependency resolution. Exploitation requires network access with no privileges (AV:N/AC:H/PR:N) and can result in high confidentiality and integrity impacts (C:H/I:H/A:N), with a CVSS v3.1 base score of 7.4. The attack is linked to CWE-494 and CWE-829.

The Gradle security advisory at https://github.com/gradle/gradle/security/advisories/GHSA-mqwm-5m85-gmcv details the mitigation: Gradle 9.3.0 introduces a behavioral change to treat these exceptions as fatal, halting further repository searches upon encountering them after maximum retries. Users should upgrade to Gradle 9.3.0 or later to prevent fallback to potentially compromised repositories.

Details

CWE(s)

Affected Products

gradle
gradle
≤ 8.14.4 · 9.0.0 — 9.3.0

CVEs Like This One

CVE-2026-22816Same product: Gradle Gradle
CVE-2025-69263Shared CWE-494
CVE-2026-25063Same vendor: Gradle
CVE-2025-27607Shared CWE-829
CVE-2025-27510Shared CWE-829
CVE-2025-15612Shared CWE-829
CVE-2026-43569Shared CWE-829
CVE-2026-34841Shared CWE-494
CVE-2025-34212Shared CWE-494
CVE-2026-26974Shared CWE-829

References