What’s Vulnerable › Products

Cloudflare WARP vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your Cloudflare WARP version is affected

Latest Cloudflare WARP vulnerabilities

• CVE-2025-0651 — File symlink abuse might lead to deleting files belonging to SYSTEM user (CVSS 7.1)
• CVE-2023-3747 — Insufficient Validation on Override Codes for Always-Enabled WARP Mode (CVSS 5.5)
• CVE-2023-0654 — Spoofing User's Activity Loads in WARP Mobile Client (Android) (CVSS 3.7)
• CVE-2023-0238 — Injecting Activity Loads in WARP Mobile Client (CVSS 5.5)
• CVE-2023-2754 — Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client (CVSS 6.8)
• CVE-2023-1862 — Remote access to warp-svc.exe in Cloudflare WARP (CVSS 7.3)
• CVE-2023-0652 — Local Privilege Escalation in Cloudflare WARP Installer (Windows) (CVSS 7.8)
• CVE-2023-1412 — Local Privilege Escalation Vulnerability in WARP's MSI Installer (CVSS 7.8)
• CVE-2022-4457 — WARP client manifest misconfiguration leading to Task Hijacking (CVSS 5.5)
• CVE-2022-4428 — support_uri validation missing in WARP client for Windows (CVSS 8.0)
• CVE-2022-3512 — Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command (CVSS 8.8)
• CVE-2022-3320 — Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command (CVSS 9.8)
• CVE-2022-2225 — Zero Trust Secure Web Gateway policies bypass using WARP client subcommands (CVSS 7.8)
• CVE-2022-2145 — Cloudlfare WARP Arbitrary File Overwrite (CVSS 7.8)
• CVE-2022-2147 — Unquoted Service Path in Cloudflare WARP for Windows (CVSS 7.8)
• CVE-2020-35152 — Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows (CVSS 7.8)