Fortra · Cobalt Strike

CVE-2022-39197

Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

Exploited in attacks Medium 6.1 Attack chance: 47%

What it is

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

CISA: Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 20, 2023

Added to the CISA list: March 30, 2023
Published: September 22, 2022
Severity: Medium 6.1 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 47% in the top 1.2% of all known vulnerabilities
Weakness: CWE-20 CWE-79
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Fortra

Added	Vulnerability	Product	Severity	Attack chance
Mar 30, 2023	User Interface Remote Code ExecutionCVE-2022-42948	Cobalt Strike	Critical 9.8	2.7%
Sep 29, 2025	Deserialization of Untrusted DataCVE-2025-10035used by ransomware	GoAnywhere MFT	Critical 10.0	99.8%
Feb 10, 2023	Remote Code ExecutionCVE-2023-0669used by ransomware	GoAnywhere MFT	High 7.2	>99.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.