Security readout for executives and security teams
Plain-English summary
CVE-2026-22723 is a Cloud Foundry UAA logic flaw that can cause inappropriate user token revocation. The main business risk is availability: users or services may lose valid access tokens unexpectedly, disrupting authentication-dependent operations. The provided sources do not show active exploitation.
Executive priority
Treat this as a moderate-priority availability risk for Cloud Foundry environments. It is not currently cited as actively exploited, but affected authentication infrastructure can create service disruption if tokens are revoked incorrectly.
Technical view
The issue affects Cloud Foundry UAA v77.30.0 through v78.7.0 and Cloud Foundry Deployment v48.7.0 through v54.10.0. CVSS 3.1 is 6.5, with network access, low complexity, low privileges, no user interaction, and high availability impact. Listed CWEs are CWE-640 and CWE-693.
Likely exposure
Exposure is likely limited to environments running the named Cloud Foundry UAA or Cloud Foundry Deployment version ranges. Organizations should verify exact deployed versions and whether UAA token revocation functionality is reachable by authenticated users.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation or public weaponization. Risk is still operationally relevant because the CVSS vector indicates authenticated network access could affect availability without user interaction.
Researcher notes
Evidence is limited to the CVE metadata and Cloud Foundry advisory reference. The bundle does not name a fixed version or detailed mitigation. Avoid assuming confidentiality or integrity impact because the CVSS vector lists C:N and I:N.
Mitigation direction
- Check Cloud Foundry advisory for fixed versions and upgrade guidance.
- Inventory UAA and Cloud Foundry Deployment versions across all foundations.
- Prioritize upgrades for internet-facing or broadly accessible UAA deployments.
- Review monitoring for unexpected token revocation spikes or authentication disruption.
- Restrict administrative and token-management access to least privilege where applicable.
Validation and detection
- Confirm whether UAA versions fall within v77.30.0 through v78.7.0.
- Confirm whether Cloud Foundry Deployment versions fall within v48.7.0 through v54.10.0.
- Review UAA logs for unusual token revocation activity.
- Validate that vendor-recommended patched versions are deployed after remediation.
- Check authentication-dependent services for recent unexplained availability incidents.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-640: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-693: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22723 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6vmwareVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cloudfoundry.org/blog/cve-2026-22723-uaa-user-token-revocation/CVE reference, vmware
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Weak Password Recovery Mechanism for Forgotten Password
Weak Password Recovery Mechanism for Forgotten Password represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Protection Mechanism Failure
Protection Mechanism Failure represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.