CVE-2022-42948
Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Published Mar 24, 2023 · updated Jun 16, 2026 · helpsystems cobalt strike
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2023 · Catalog
Detected
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Mar 30, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 20, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
Required action
Apply updates per vendor instructions.
CISA due date Apr 20, 2023
Affected
- cpe helpsystems/cobalt strike4.7.1
- vendor Fortra Cobalt Strikeversion unspecified
Sources
- CISA KEVCVE-2022-42948
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
cisa.gov - CVE.orgCVE-2022-42948
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-42948
30-day exploitation probability 2.7%
first.org - NIST NVDCVE-2022-42948
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
nvd.nist.gov