ClosedPatched

Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)

Fortra Cobalt Strike

Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.

Why this severity: CVSS 9.8 (NVD), actively exploited (CISA KEV)

Started: Mar 30, 2023
Closed: Mar 30, 2023
CVEs: CVE-2022-39197 CVE-2022-42948

Follow this incident

Updated Mar 30, 2023

Affected

See vendor advisory / CISA notes (versions not always listed in KEV feed)

Fixed in

See vendor advisory linked in sources

Timeline2

Mar 30, 2023
CISA added CVE-2022-39197 to the KEV catalog (due 2023-04-20).
Mar 30, 2023
CISA added CVE-2022-42948 to the KEV catalog (due 2023-04-20).

Advisories5

Notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier). Grouped: same vendor/product added to KEV on the same day.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified