Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2022-39197: Cobalt Strike Teamserver lets attacker run code via username
CVE-2022-39197 · published 4 years ago · actively exploited
Summary
The Teamserver part of Fortra Cobalt Strike can be tricked by a specially crafted username to execute unwanted code. This could let an attacker take control of the server or data. Apply the latest patches from Fortra and restrict who can access the Teamserver interface.
What to do
- Update helpsystems cobalt_strike to version 4.7.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortra | cobalt strike | All versions |
| helpsystems | cobalt_strike |
< 4.7.1 cpe:2.3:a:helpsystems:cobalt_strike:*:*:*:*:*:*:*:* |
Original advisory text
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
References
- https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/ Mitigation Vendor Advisory
- https://www.cobaltstrike.com/blog/tag/release/ Release Notes Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-... US Government Resource
Internet-facing
14 days
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.1
Medium
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
44%
chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published22 Sep 2022
Updated30 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta