Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)
Netwrix Auditor
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Added to CISA KEV on 2023-07-11. CISA lists known use in ransomware campaigns.
Why this severity: CVSS 9.8 (NVD), actively exploited (CISA KEV), known ransomware use
- Started
- Jul 11, 2023
- Closed
- Jul 11, 2023
Affected
- See vendor advisory / CISA notes (versions not always listed in KEV feed)
Fixed in
- See vendor advisory linked in sources
Timeline1
CISA added CVE-2022-31199 to the KEV catalog (due 2023-08-01).
Advisories2
Notes & caveats
Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
