CVE-2022-44262

CRITICAL LAB

ff4j 1.8.1 - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2022-44262. PoCs published by shoucheng3.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2022-44262, a vulnerability in FF4J (Feature Flipping for Java). The exploit appears to target the AOP (Aspect-Oriented Programming) component, likely involving improper input validation or injection.

Description

ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).

Exploits (2)

nomisec WORKING POC
by shoucheng3 · poc
https://github.com/shoucheng3/ff4j__ff4j_CVE-2022-44262_1_8_13_fixed

This repository contains a proof-of-concept for CVE-2022-44262, a vulnerability in FF4J (Feature Flipping for Java). The exploit appears to target the AOP (Aspect-Oriented Programming) component, likely involving improper input validation or injection.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: FF4J 1.8.13
No auth needed
Prerequisites: Access to the FF4J web console or API · Vulnerable version of FF4J (1.8.13 or earlier)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by shoucheng3 · poc
https://github.com/shoucheng3/ff4j__ff4j_CVE-2022-44262_1-8-13

The repository appears to be a partial or incomplete snapshot of the FF4J project, focusing on AOP-related files. No exploit code or proof-of-concept for CVE-2022-44262 is present in the provided files.

Classification
Stub 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: FF4J (Feature Flipping for Java)
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory
https://github.com/ff4j/ff4j/issues/624

Scores

CVSS v3 9.8
EPSS 0.0121
EPSS Percentile 79.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Lab Environment

COMMUNITY
Community Lab
docker pull cassandra:3.11.7
docker pull docker.elastic.co/elasticsearch/elasticsearch:7.6.2
docker pull docker.elastic.co/kibana/kibana:7.6.2

Details

CWE
CWE-94
Status published
Products (2)
ff4j/ff4j 1.8.1
org.ff4j/ff4j-core 1.8.1 - 1.9Maven
Published Dec 01, 2022
Tracked Since Feb 18, 2026