Technical intelligence and weaponization dossier for CVE-2022-39197. Documented exploitation across 0 active malware families totaling 0 analyzed telemetry samples.
| Vulnerability ID | CVE-2022-39197 |
|---|---|
| Common Name / Bulletin | Cobalt Strike Team Server Cross-Site Scripting / RCE via Beacon Metadata (Fortra Cobalt Strike Advisory) |
| CWE Classification | CWE-79: Improper Neutralization of Input in Team Server UI |
| Affected Software & Versions | Cobalt Strike versions prior to 4.7.1 |
| Technical Root Cause | XSS vulnerability in Cobalt Strike Team Server UI when displaying beacon process list telemetry, allowing targeted adversaries or defenders to exploit operator consoles. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 0 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2022-39197 in enterprise networks:
Beacon process list checkin payloads containing HTML/SVG tags (<svg onload=...>) directed at known Team Server listeners.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →