CVSS 8.8 HIGH Bulletin: Fortra Cobalt Strike Security Advisory 4.7.2 Published: 2022-10-18

CVE-2022-42948: Fortra Cobalt Strike Team Server Remote Code Execution via XSS in Beacon Console

Technical intelligence and weaponization dossier for CVE-2022-42948. Documented exploitation across 1 active malware families totaling 3,500 analyzed telemetry samples.

Attributed Families

Sample Volume

3,500

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2022-42948
Common Name / Bulletin	Fortra Cobalt Strike Team Server Remote Code Execution via XSS in Beacon Console (`Fortra Cobalt Strike Security Advisory 4.7.2`)
CWE Classification	`CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')`
Affected Software & Versions	Cobalt Strike versions 4.0 through 4.7.1
Technical Root Cause	Improper input validation and neutralization of HTML tags in Beacon registration metadata rendered within the Team Server Swing UI console, allowing simulated or hostile beacons to trigger code execution on operator consoles.
Associated ATT&CK Techniques	`T1203` — Associated ATT&CK Technique `T1059` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2022-42948

Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

1 families

Malware Family	Category	Catalog Samples	Operational Profile
cobaltstrike	Hacktool	`3,500`	Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Origin...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2022-42948 in enterprise intrusions and campaign toolkits:

APT29 — Attributed Threat Group / Campaign Operator
APT41 — Attributed Threat Group / Campaign Operator
BlackCat Syndicate — Attributed Threat Group / Campaign Operator
FIN7 — Attributed Threat Group / Campaign Operator
LockBit Syndicate — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2022-42948 in enterprise networks:

Beacon check-in network traffic containing embedded HTML elements (<object>, <iframe>, <script>) in computer name, user name, or process metadata fields.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Upgrade Cobalt Strike infrastructure to version 4.7.2 or later; restrict Team Server management ports to dedicated management VPNs.

For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →

← Return to Vulnerability Matrix Directory (All 63 CVEs)