The exploitation of two (2) critical zero-day vulnerabilities in the Spring Core Java application framework known as “Spring4Shell” could allow unauthenticated attackers to remotely execute arbitrary code. Spring is a very popular framework with Java developers, because it allows them to easily code enterprise-level features into their applications, which can then be deployed on servers as stand-alone packages. The “Spring4Shell” vulnerability, tracked as CVE-2022-22965, is one (1) of two (2) disclosed remote code execution (RCE) vulnerabilities. The less severe bug is tracked as CVE-2022-22963 and exists in the Spring Cloud function. Both vulnerabilities have associated Proof-of-Concept (PoC) exploits, demonstrating the successful exploitation of “Spring4Shell” due to the unsafe deserialization of passed arguments. These vulnerabilities affect Spring MVC and Spring WebFlux apps running on JDK 9+. This is a very dangerous bug due to its popularity and because it is being compared to the infamous “Log4Shell” vulnerability, but it only exists on specific configurations of the Spring framework where Tomcat is run on the application as a WAR deployment. Therefore, it is less likely to be exploited en masse in the same way that “Log4Shell” was. “Spring4Shell” has been patched, and users are urged to upgrade to Spring Boot version 2.6.6, and Spring Cloud Function 3.1.7/3.2.3 immediately. In addition, VMware has also released mitigations for situations where the patch cannot be downloaded. The Ankura CTIX analysts will continue to report on critical development-based vulnerabilities, and we recommend that any users running Spring ensure that the Advanced Exploit Prevention and Network Attack Blocker features are enabled as a best practice.