BLUF

CVE-2026-22738 introduces a high-impact risk to organizations deploying VMware Spring AI by enabling adversaries to drive unintended backend execution through prompt-controlled inputs, creating a direct path from external user interaction to internal system execution. The vulnerability is caused by the absence of strict separation between user-controlled prompt content and trusted execution context, allowing model-generated output to influence backend tool invocation without sufficient validation or restriction. While not currently listed in the CISA Known Exploited Vulnerabilities catalog, the exposure model aligns closely with attacker-preferred remote code execution pathways and carries a high exploitation exposure probability.

This amended detection-readiness edition adds PraisonAI CVE-2026-44338 as related AI-orchestration exposure context and extends the report’s behavioral detection model for environments where PraisonAI services are present. The PraisonAI addition does not change the primary scope, scoring, affected technology, or Spring AI-focused detection engineering in this report. It is included because it reinforces the same defensive concern: AI orchestration layers can become trusted automation and execution surfaces when workflow access, authentication, execution boundaries, and downstream credential controls are weak.

Organizations should immediately restrict prompt-to-execution pathways, enforce validation and allowlisting of tool invocation logic, monitor for abnormal execution behavior within AI-enabled application services, and apply the PraisonAI detection-readiness extension where PraisonAI services are present, internet-reachable, connected to sensitive integrations, or already covered by alerting.

Executive Risk Translation

Prompt-driven execution bypasses traditional security controls, allowing attackers to operate inside trusted application workflows with high likelihood of rapid weaponization once exploitation techniques mature. The PraisonAI addendum reinforces that the same defensive concern extends beyond prompt injection alone: exposed AI orchestration interfaces can also become trusted automation surfaces when workflow access, authentication, execution boundaries, and downstream credential controls are weak.

Why This Matters Now

• VMware Spring AI is being integrated into enterprise Java and Spring-based microservices, embedding AI-driven execution logic directly into production application workflows
• The framework links user-controlled input, model processing, and backend execution, creating a trust boundary where externally supplied data can shape internal system behavior
• Traditional controls such as web application firewalls and API gateways are not designed to detect or constrain model-mediated execution chains
• CVE-2026-22738 represents a new class of application-layer vulnerability where natural language input can directly influence backend execution pathways

Key Judgments

• CVE-2026-22738 enables a direct execution pathway from user-controlled input to backend application logic via model-mediated tool invocation
• Exploitation requires only access to an exposed prompt ingestion interface and does not depend on authentication in externally accessible deployments
• The vulnerability aligns with remote code execution tradecraft and is highly likely to be adopted rapidly by attackers once exploitation patterns are operationalized
• Detection is dependent on behavioral monitoring of execution and identity activity rather than traditional signature-based approaches
• Organizations deploying AI-enabled application frameworks without execution boundary controls face elevated risk of undetected compromise

Executive Risk Summary

CVE-2026-22738 introduces a high-risk execution pathway within AI-enabled application environments, enabling adversaries to influence backend system behavior through prompt-controlled input. Although not currently listed in the KEV catalog, the vulnerability exhibits characteristics consistent with high-priority exploitation candidates, including low attacker complexity, high scalability across enterprise environments, and direct alignment with remote code execution objectives. The primary risk is the breakdown of trust boundaries within application logic, allowing attacker-controlled instructions to execute within trusted service contexts. Organizations with exposed Spring AI deployments should treat this vulnerability as high priority despite the absence of confirmed exploitation.

Executive Cost Summary

This cost analysis was developed by the CyberDax team using expert judgment and assisted analytical tools to support clarity and consistency.

• Low Impact: $200,000–$800,000 — Limited compromise of isolated AI-enabled application components with constrained backend execution exposure and minimal sensitive data interaction
• Moderate Impact: $800,000–$4 million — Unauthorized execution within application services enabling access to internal APIs, service-to-service interactions, or moderate data exposure requiring investigation and partial system rebuild
• High Impact: $4 million–$15 million — Widespread exploitation of AI-integrated application environments enabling persistent execution pathways, data exfiltration, and disruption of critical business services

Key Cost Drivers

• Extent of VMware Spring AI deployment across production environments
• Sensitivity of data accessible through AI-enabled application workflows
• Time to detection of abnormal execution within trusted application contexts
• Complexity of isolating and rebuilding compromised AI-integrated services
• Dependency on backend tools and APIs exposed to model-mediated execution

Compliance and Risk Context

Compliance Exposure Indicator
High

Risk Register Entry
CVE-2026-22738 introduces a prompt-driven execution vulnerability within VMware Spring AI that enables user-controlled input to influence backend application behavior, bypassing traditional input validation controls and exposing enterprise systems to unauthorized execution and data access risk.

Annualized Risk Exposure

Estimated $3.0M–$10.5M annually based on:

• High exploitation exposure probability (EEP: 94/100)
• Likelihood of attacker adoption following disclosure of prompt-injection execution techniques
• Expanding enterprise deployment of AI-enabled application frameworks
• Moderate-to-high impact cost scenarios driven by application-layer compromise and backend execution exposure

Executive Risk Scoring

Overall Risk Rating
High

Exploitability Rating
High

Impact Rating
High

Exposure Rating
High

Exploitation Exposure Probability (EEP)
94/100

EEP is a forward-looking analytic measure of operational exploitation potential, not a statement of confirmed exploitation, KEV inclusion, or incident activity.

KEV Alignment Status
Not currently listed in the CISA Known Exploited Vulnerabilities Catalog

KEV Likelihood Assessment
High

Risk Prioritization Tier
Tier 1 — Immediate Action Required

Operational Priority
Immediate — organizations should prioritize mitigation of prompt-to-execution pathways and enforce strict validation of model-driven actions within application services

Bottom Line for Executives

CVE-2026-22738 represents a high-risk vulnerability in AI-enabled application frameworks that allows attacker-controlled input to influence backend execution behavior, effectively bypassing traditional security controls. Organizations deploying VMware Spring AI should assume elevated risk and implement immediate controls to restrict execution pathways, validate model-driven actions, and monitor for anomalous behavior within application services.

Board-Level Takeaway

The emergence of CVE-2026-22738 highlights a structural shift in application risk where natural language input can directly influence system execution, bypassing conventional security controls. This vulnerability reflects a broader governance challenge associated with AI integration into enterprise systems, requiring oversight of how AI-driven functionality interacts with backend execution logic and critical business processes.

Vulnerability Overview

Vulnerability Type
Prompt Injection leading to Remote Code Execution

Affected Component
VMware Spring AI prompt handling and tool execution pipeline

Description
CVE-2026-22738 is a prompt injection vulnerability in VMware Spring AI that allows adversaries to embed malicious instructions within user-controlled input, causing the large language model to generate unauthorized tool invocation commands. Because the framework does not enforce strict separation between user input and execution context, these instructions can be interpreted as trusted system actions, resulting in remote code execution within the application environment.

Technical Vulnerability Details

Technical Failure Condition
User-controlled prompt content is not adequately isolated from system-level instruction handling and downstream execution logic.

Execution Path Exposure

• User-controlled input is incorporated into LLM prompts
• Model output is permitted to influence backend tool invocation
• Application logic interprets model-mediated output as actionable execution context
• Backend tools, APIs, or service workflows may execute without sufficient validation or allowlisting

Root Cause Components

• Failure to enforce strict separation between user-controlled prompt content and system-level instructions
• Implicit trust of LLM-generated output as executable or actionable logic
• Absence of validation or allowlisting for tool invocation requests generated by the model
• Lack of contextual integrity controls to prevent prompt injection from influencing execution pathways
• Design assumption that LLM responses are non-adversarial, enabling attacker-controlled instruction flow into backend operations

Exploitability Assessment

Exploitability
High — exploitation requires injection of crafted prompt content through chat interfaces, API input fields, or user-supplied data ingestion paths where model output can influence backend execution behavior.

Attack Requirements

• Externally reachable or otherwise attacker-accessible input path into Spring AI workflow
• LLM output permitted to influence backend tool invocation, service actions, or execution logic
• Insufficient validation, allowlisting, or isolation between model output and execution layer

Attack Complexity
Low to Moderate — complexity decreases materially once a reachable prompt injection path and executable downstream function path are identified.

Exposure Conditions

• Applications exposing LLM interfaces to untrusted users
• Systems where LLM output can trigger API calls, shell execution, or backend service workflows
• Environments lacking prompt sanitization, output validation, or tool execution allowlisting

KEV Status and Patch Availability

KEV Status
Not present in the CISA Known Exploited Vulnerabilities Catalog at time of analysis.

KEV Likelihood Assessment

High likelihood of future KEV inclusion based on:

• Strong alignment with remote code execution exposure patterns
• Exploitation path requiring only prompt injection into externally accessible interfaces
• Increasing attacker focus on AI-enabled application execution pathways
• Broad applicability across enterprise Spring AI deployments

Exploitation Exposure Probability (EEP)
High (94/100)

EEP is a forward-looking analytic measure of operational exploitation potential, not a statement of confirmed exploitation, KEV inclusion, or incident activity.

KEV Prioritization Implication

Although not currently KEV-listed, this vulnerability should be treated with KEV-equivalent prioritization due to high exploitation likelihood and low barrier to attacker adoption once exploitation techniques are operationalized.

Patch Availability

No authoritative public vendor advisory or confirmed patch guidance identified at time of analysis.

Patch / Remediation Status

• Vendor advisory confirmation required
• If no patch is available, mitigation must focus on:

o   prompt isolation

o   tool invocation validation

o   execution boundary enforcement

o   restriction of backend function exposure to AI workflows

Exposure Management Priority

High — organizations should identify Spring AI deployments, restrict prompt-to-execution pathways, validate model-mediated tool invocation logic, and monitor for abnormal execution behavior within AI-enabled application services.

Sectors / Countries Affected

Sectors Affected

• Technology and SaaS providers deploying Spring-based microservices with embedded AI functionality
• Financial services platforms using AI-driven customer interaction, automation, or decision workflows
• Healthcare organizations integrating AI into data processing, summarization, or operational decision-support systems

Countries Affected

• United States
• United Kingdom
• European Union member states
• Asia-Pacific regions with high SaaS and cloud adoption

Adversary Capability Profiling

Skill Level
Moderate — exploitation relies on manipulation of AI workflows and input shaping rather than advanced exploit development

Infrastructure Requirements
Minimal — standard HTTP or API interaction is sufficient where AI-enabled endpoints are externally reachable

Scalability
High — prompt-based and API-driven interaction can be automated across multiple exposed applications

Operational Objectives

• Achieve application-layer execution through AI-mediated backend invocation paths
• Access sensitive data processed within AI-enabled workflows and connected systems
• Establish footholds within trusted application service contexts
• Enable broader enterprise compromise through application-layer entry points

Targeting Probability Assessment

High Probability Targets

• Public-facing AI-enabled applications exposing prompt-driven interaction, assistant features, search, or workflow automation
• SaaS platforms embedding Spring AI where a single execution pattern can be reused across multiple tenants or customer environments

Medium Probability Targets

• Enterprise systems with externally accessible APIs that route user-controlled data into AI orchestration workflows

Lower Probability Targets

• Isolated systems without external input paths into AI processing or without backend execution linked to model-influenced output

Assessment Basis
Attackers prioritize environments where Spring AI increases execution reach, concentrates high-value business data, and enables scalable exploitation through internet-facing workflows with low interaction cost

MITRE ATT&CK Chain Flow Mapping

Initial Access

T1190 – Exploit Public-Facing Application

Attackers deliver crafted prompt or API input to externally exposed Spring AI endpoints, allowing untrusted input to enter orchestration workflows.
Execution

T1059 – Command and Scripting Interpreter
Model-mediated output influences backend logic, resulting in execution of commands, scripts, or function calls within JVM-based services.

Credential Access (Follow-on)

T1552 – Unsecured Credentials
Execution within application context may expose environment variables, API keys, or service tokens accessible to the compromised process.

Command and Control (Follow-on)

T1071 – Application Layer Protocol
Compromised application services may communicate externally over HTTP or HTTPS as part of attacker-influenced execution.

Exfiltration (Follow-on)

T1041 – Exfiltration Over C2 Channel
Data may be exfiltrated through application-initiated outbound communication controlled by attacker-influenced execution.

Defense Evasion (Execution Layer)

T1027 – Obfuscated/Compressed Files and Information
Malicious logic is embedded within prompt manipulation and model-driven execution, blending with legitimate application behavior.

Conditional Post-Exploitation Behaviors

• T1505 – Server Software Component
  Not observed in currently available reporting; may occur during post-exploitation depending on attacker objectives and target environment.
• T1021 – Remote Services
  Not observed in currently available reporting; may occur if compromised services enable lateral connectivity.
• T1082 – System Information Discovery
  Not observed in currently available reporting; may occur if backend execution enables system or environment inspection.
• T1068 – Exploitation for Privilege Escalation
  Not observed in currently available reporting; may occur if execution context allows elevation beyond initial service privileges.

Attack Path Narrative (Signal-Aligned Execution Flow)

An attacker initiates activity by submitting crafted prompt or API input to an externally accessible AI-enabled application endpoint, producing observable inbound requests at the application layer, including anomalous prompt structures, unexpected parameter combinations, or irregular request frequency within API and AI workflow logs.

The request is processed by the Spring AI orchestration layer, where model inference occurs. At this stage, direct network-level visibility is limited, but deviations may be observable in application telemetry, prompt handling logs, or inconsistencies in request-response behavior compared to normal workflow patterns.

As model-influenced output is generated, it drives downstream application decision logic, resulting in backend function invocation or execution-path selection. This transition produces observable signals such as unexpected service-to-service calls, abnormal function usage patterns, or deviations in execution flow within JVM-based service telemetry and application tracing systems.

Execution occurs within a legitimate application process, causing malicious activity to blend into normal operations. Detection signals become most visible when correlating endpoint process activity, application execution logs, and outbound network communication, where anomalies such as unexpected command execution behavior, irregular data access, or non-standard outbound connections may appear.

Once execution is achieved, attacker influence over application behavior produces follow-on observable activity, including unauthorized data retrieval patterns, abnormal service interactions, and outbound communication inconsistent with baseline application behavior, indicating potential compromise of the AI-enabled service context.

Attack Chain Risk Amplification Summary

Spring AI orchestration consolidates user input handling, model inference, and backend execution into a single trust boundary, increasing the likelihood that attacker-controlled input can influence sensitive operations before validation or control mechanisms are applied.

Model-mediated execution introduces an abstraction layer between input and action, where the decision point driving backend behavior resides within model output rather than explicit application logic, reducing transparency and complicating detection and forensic attribution.

Malicious activity executes within legitimate JVM service processes and application workflows, allowing attacker behavior to align with expected operational patterns and reducing the effectiveness of traditional signature-based or rule-based detection approaches.

Detection is further degraded when organizations lack consistent correlation between prompt input, model output, and backend execution events, particularly in environments where logging does not preserve end-to-end linkage across AI workflows and application execution paths.

References

Vendor Advisory

• Spring Security Advisory — SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution (CVE-2026-22738)
• hxxps://spring[.]io/security/cve-2026-22738

Vulnerability Records

• National Vulnerability Database (NVD) — CVE-2026-22738 vulnerability record
• hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-22738
• Tenable CVE Coverage — Detection and plugin intelligence for CVE-2026-22738
• hxxps://www[.]tenable[.]com/cve/CVE-2026-22738/plugins

Related Watchlist Vulnerability Records

• GitHub Advisory Database — PraisonAI CVE-2026-44338 / GHSA-6rmh-7xcm-cpxj
• hxxps://github[.]com/advisories/GHSA-6rmh-7xcm-cpxj
• OpenCVE — PraisonAI CVE-2026-44338 vulnerability record
• hxxps://app[.]opencve[.]io/cve/CVE-2026-44338

Known Exploited Vulnerabilities (KEV)

• CISA Known Exploited Vulnerabilities Catalog
• hxxps://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog

Security Vendor Analysis

• Not applicable — no independent third-party original research identified beyond vendor advisory, vulnerability records, and related watchlist records.

Analytical Framework

• MITRE ATT&CK Framework
• hxxps://attack[.]mitre[.]org

Reference Usage Note

• PraisonAI CVE-2026-44338 is included as related watchlist context for AI-orchestration exposure and detection-readiness analysis.
• PraisonAI CVE-2026-44338 is not used as primary evidence for VMware Spring AI CVE-2026-22738 exploitation, scoring, affected-technology scope, or Spring AI-specific rule engineering.
• At the time of amendment, PraisonAI CVE-2026-44338 is not treated in this report as confirmed exploitation, KEV-listed activity, campaign evidence, or a co-equal primary CVE. It is referenced only to support the related AI-orchestration exposure pattern and adapted PraisonAI detection-extension guidance.