CVE•Published 2025-09-16•Modified 2026-10-18•1 article on news•6 live references•NVD data

CVE-2025-41243

Vulnerability data via NVD (ingested)

CVSS v3.1

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 11% of all CVEs

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Description

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.

Timeline

Published 2025-09-16

Modified 2026-10-18

External references

NVD MITRE GitHub PoC Sploitus trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-41243

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2025-41243

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2025-41243

Censys host search filtered to this CVE id.

grep.app

CVE-2025-41243