CVE-2022-42948
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 3% (percentile: 86) as of 2 November 2026
- CWE
- CWE-116
Affected products
helpsystems: cobalt strike
References
- https://www.cobaltstrike.com/blog/ Vendor Advisory
- https://www.cobaltstrike.com/blog/ Vendor Advisory
- https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability… Technical DescriptionThird Party Advisory
- https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-… Third Party Advisory
- https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability… Technical DescriptionThird Party Advisory
- https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-… Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022… US Government Resource