Spring Boot Actuator Sensitive Endpoint Probe for 2026-08-26

Aug 26, 2026 Exploitation

Last Updated: 00:00 UTC

Spring Boot Actuator exposes management endpoints. heapdump returns a full JVM heap snapshot containing in-memory secrets. env returns all environment variables. gateway/routes is the RCE precursor for CVE-2022-22947 (Spring Cloud Gateway SPEL injection).

CVE References

CVE-2022-22947

MITRE ATT&CK

Tactic: Discovery (TA0007)
Technique: T1046 — Network Service Scanning

Observed URIs

Attackers by Country

Hong Kong: 5United States of America: 2
Hong Kong571.4%
United States of America228.6%

IP Address : ASN : City/Provider

  • 111.68.5.110 : AS45753 netsec limited : Hong Kong

  • 111.68.5.114 : AS45753 netsec limited : Hong Kong

  • 112.121.183.38 : AS45753 netsec limited : Hong Kong

  • 166.88.26.174 : AS18779 egihosting : United States of America

  • 182.16.91.254 : AS45753 netsec limited : Hong Kong

  • 216.118.251.50 : AS45753 netsec limited : Hong Kong

  • 34.186.83.156 : AS15169 google llc : United States of America

  • 45.45.237.97 : ASNone : unknown

  • 93.123.109.228 : unknown : unknown

Share on: