What’s Vulnerable › Vulnerabilities

CVE-2022-22996: SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-30 · updated 2026-06-17
• Weakness: CWE-427

Description

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user.

Affected products

• Westerndigital Sandisk Professional G-Raid 4/8 Software Utility: before 300520006-2 — fixed in 300520006-2
• Westerndigital Sandisk Professional G-Raid 4/8 Software Utility Driver: before 6.2.0.16-2 — fixed in 6.2.0.16-2

How to fix

Upgrade to a fixed version: Westerndigital Sandisk Professional G-Raid 4/8 Software Utility 300520006-2; Westerndigital Sandisk Professional G-Raid 4/8 Software Utility Driver 6.2.0.16-2. Check the vendor advisory for mitigations.

References

• https://www.westerndigital.com/support/product-security/wdc-22007-sandisk-professional-g-raid-4-8-software-utility-setup-for-windows-privilege-escalation
• https://www.westerndigital.com/support/product-security/wdc-22007-sandisk-professional-g-raid-4-8-software-utility-setup-for-windows-privilege-escalation

Get alerted when CVE-2022-22996 or the next vulnerability affects your stack