How severe is CVE-2022-42948?

CVE-2022-42948 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-42948 being actively exploited?

Yes. CVE-2022-42948 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-03-30, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2022-42948?

CVE-2022-42948 affects Helpsystems Cobalt Strike. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-42948?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2022-42948 have an EU (EUVD) identifier?

Yes. CVE-2022-42948 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-46004. It is also flagged as exploited in the EUVD (since 2023-03-30).

When was CVE-2022-42948 published?

CVE-2022-42948 was published on 2023-03-24 and last updated on 2026-06-17.

CVE-2022-42948

CVE-2022-42948 is a critical-severity vulnerability in Helpsystems Cobalt Strike with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2023-03-30). The underlying weakness is classified as CWE-116.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 3% (84th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2023-03-30)
EU (EUVD) id: EUVD-2022-46004
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2023-03-30)
Weakness: CWE-116
Affected product: Helpsystems Cobalt Strike
Published: 2023-03-24
Last modified: 2026-06-17

Description

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

Frequently asked questions

What is CVE-2022-42948?: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
How severe is CVE-2022-42948?: CVE-2022-42948 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-42948 being actively exploited?: Yes. CVE-2022-42948 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-03-30, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2022-42948?: CVE-2022-42948 affects Helpsystems Cobalt Strike. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-42948?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2022-42948 have an EU (EUVD) identifier?: Yes. CVE-2022-42948 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-46004. It is also flagged as exploited in the EUVD (since 2023-03-30).
When was CVE-2022-42948 published?: CVE-2022-42948 was published on 2023-03-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:helpsystems:cobalt_strike:4.7.1:*:*:*:*:*:*:*

More vulnerabilities in Helpsystems Cobalt Strike

CVE-2022-23317 — High (CVSS 7.5): CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can…
CVE-2021-36798 — High (CVSS 7.5): A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It…
CVE-2022-39197 — Medium (CVSS 6.1): An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote…

All CVEs affecting Helpsystems Cobalt Strike →

Other CWE-116 vulnerabilities

CVE-2025-55730 — Critical (CVSS 10.0): XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in…
CVE-2025-55729 — Critical (CVSS 10.0): XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in…
CVE-2023-47143 — Critical (CVSS 10.0): IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection,…
CVE-2023-26472 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with…
CVE-2022-41934 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with…
CVE-2022-36100 — Critical (CVSS 9.9): XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform.…

Browse all CWE-116 vulnerabilities →