Fortra · Cobalt Strike

CVE-2022-42948

Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 2.7%

What it is

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

CISA: Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 20, 2023

Added to the CISA list: March 30, 2023
Published: March 24, 2023
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 2.7% in the top 14.1% of all known vulnerabilities
Weakness: CWE-79 CWE-116
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Fortra

Added	Vulnerability	Product	Severity	Attack chance
Mar 30, 2023	Teamserver Cross-Site Scripting (XSS)CVE-2022-39197	Cobalt Strike	Medium 6.1	47%
Sep 29, 2025	Deserialization of Untrusted DataCVE-2025-10035used by ransomware	GoAnywhere MFT	Critical 10.0	99.8%
Feb 10, 2023	Remote Code ExecutionCVE-2023-0669used by ransomware	GoAnywhere MFT	High 7.2	>99.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.