ZeroDay Findings
Sign inSign up

Findings

CVE-2022-39197

Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

Published Sep 21, 2022 · updated Jun 16, 2026 · helpsystems cobalt strike

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

Timeline

Detection, updates, and resolution for this record.

  1. Sep 21, 2022 · Catalog

    Detected

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be

  2. Mar 30, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 20, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be

Required action

Apply updates per vendor instructions.

CISA due date Apr 20, 2023

Affected

  • cpe helpsystems/cobalt strikeversion unspecified
  • vendor Fortra Cobalt Strikeversion unspecified

Sources

  • CISA KEVCVE-2022-39197

    Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.

    cisa.gov
  • CVE.orgCVE-2022-39197

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-39197

    30-day exploitation probability 46.4%

    first.org
  • NIST NVDCVE-2022-39197

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the usernam

    nvd.nist.gov

References

CVE-2022-39197 · ZeroDay Findings