AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2022-42948

CRITICAL · CVSS 9.8 EPSS 2.71% CISA KEV · Actively Exploited

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2023-03-24 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CISA KEV Details

Status: This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.

Ransomware use: Unknown

Added to KEV: 2023-03-30

Required action: Apply updates per vendor instructions.

CVE
CVE-2022-42948
Severity
CRITICAL
CVSS
9.8
EPSS
2.71%

Original NVD Description

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.