CVE-2022-3322: Lock WARP switch bypass on WARP mobile client using iOS quick action

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-28 · updated 2026-06-17
Weakness: CWE-862

Description

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.

Affected products

Cloudflare Warp Mobile Client: before 6.14 — fixed in 6.14

How to fix

Upgrade to a fixed version: Cloudflare Warp Mobile Client 6.14. Check the vendor advisory for mitigations.

References

https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj
https://github.com/cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj

Get alerted when CVE-2022-3322 or the next vulnerability affects your stack