What’s Vulnerable › Vulnerabilities

CVE-2022-42948: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-03-30
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-24 · updated 2026-06-17
• Weakness: CWE-116

Description

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

Affected products

• Helpsystems Cobalt Strike: 4.7.1

References

• https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/
• https://www.cobaltstrike.com/blog/
• https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/
• https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/
• https://www.cobaltstrike.com/blog/
• https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42948

Get alerted when CVE-2022-42948 or the next vulnerability affects your stack