Impact of the SpringShell vulnerability CVE-2022-22965

Background

The Spring Framework is an application framework for Java.

Spring Framework versions before 5.3.18 have a critical security vulnerability (CVE-2022-22965) allowing remote code execution.

Desktop apps

None of our desktop software on Mac or Windows uses Java or the Spring Framework, so is not affected by CVE-2022-22965.

OnDemand cloud app

None of our cloud software uses Java or the Spring Framework, so is not affected by CVE-2022-22965.

Note: OnDemand runs on Microsoft Azure. Microsoft did not find any Azure services using the Spring Framework.

Microsoft’s Response to CVE-2022-22965

Infrastructure

None of our core infrastructure uses Java or the Spring Framework, so is not affected by CVE-2022-22965.

Other services

Assessment of Spring Framework use by third party suppliers for services like accounting found no impact on our services.

Note: This page covers a historic vulnerability. The Spring Framework was fixed upstream in March 2022, and this assessment is complete, so the page is no longer updated.

Applies to: All products

Last reviewed: October 22, 2026