CVE-2022-31199
Actively exploited. CVE-2022-31199 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-07-11) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2022-31199 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation.
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
CSIRTS triage
- What
- An insecure object deserialization vulnerability allows an unauthenticated remote attacker to execute code as the NT AUTHORITY\SYSTEM user.
- Who is affected
- Deployments of Netwrix Auditor that have the User Activity Video Recording component accessible on port 9004/TCP.
- Urgency
- Remediation is urgent due to the critical nature of the vulnerability and its exploitation status.
- Action
- Apply the latest patch provided by Netwrix.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2022-31199
Get an email if CVE-2022-31199 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 98% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2022-31199 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
Advisory coverage (1)
- criticalexploitedCVE-2022-31199: Netwrix Auditor Insecure Object Deserialization Vulnerabilitycisa-kev · 2023-07-11
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2022-31199)