Yes. CISA added CVE-2022-39197 to its Known Exploited Vulnerabilities catalogue on 30 March 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
What this CVE tells you about active exploitation
CVE-2022-39197 should be treated as more than a theoretical vulnerability because CISA placed it in KEV, which is its operational signal that exploitation has been observed and defenders should act on it promptly. For a product used in offensive operations like Cobalt Strike, even a web-layer flaw can become a high-value entry point for post-exploitation activity.
The practical question is not whether the issue exists, but whether your Cobalt Strike Teamserver deployment is exposed in a way that an attacker can reach and manipulate. If the answer is yes, the exposure belongs in the same triage queue as any other actively exploited internet-facing weakness, with response driven by the vendor advisory and the KEV entry rather than by local assumptions about how likely abuse seems.
CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm the KEV status and required remediation timing for an actively exploited CVE.
How the XSS issue changes your response
This is a cross-site scripting issue in Teamserver, so the security concern is not just page rendering or browser behavior. The flaw can let an attacker influence the Teamserver context through a malformed Beacon configuration username, which means a management interface weakness can be turned into code execution rather than remaining a simple client-side nuisance.
That changes response priorities. A Teamserver XSS finding should be handled as a server-side compromise candidate, especially if the instance is reachable by untrusted users, exposed across trust boundaries, or used in shared operational environments. In those cases, exposure review should include who can reach the interface, what that interface can access, and whether the deployment assumptions match how the product is actually used.
Cross-Site Scripting (XSS) Prevention Guide helps map the underlying vulnerability class to the controls that normally break XSS chains.
Web Application Attacks Guide is useful when you need to place this CVE in the broader pattern of injection and browser-mediated attack paths.
What to do if you cannot patch immediately
If patching or vendor-directed remediation must wait, reduce exposure first. Place the Teamserver behind strict network controls, limit who can reach the management surface, and treat any administrative or operator credential that can touch the service as sensitive until the box is remediated. Where there is any sign the instance may already have been reached, plan for compromise review rather than relying only on the successful application of a fix.
Because this vulnerability can be paired with code execution, delaying action without compensating controls leaves you exposed to both interface abuse and possible follow-on activity. The right interim response is to narrow reachability, watch for abnormal requests or session behavior, and be ready to rotate any credentials or secrets that were usable from that Teamserver environment.
Vulnerability Management Guide is the best internal reference for triage, exception handling and post-remediation verification.
NIST National Vulnerability Database provides the canonical CVE record and supporting vulnerability metadata for tracking.
Risk and Threat Considerations
The main risk is that an actively exploited Teamserver flaw can become an operational foothold rather than a standalone web bug. When a tool associated with adversary operations is itself vulnerable, the attacker incentive is often to reach the control plane, alter configuration, or gain execution that supports persistence and further abuse.
Failure mechanism: An attacker abuses the XSS condition in Beacon configuration handling to inject malicious input into the Teamserver workflow, which can enable remote code execution and broader compromise of the management environment.
Impact: Successful exploitation can expose operator workflows, weaken confidence in the Teamserver, and create a launch point for additional malicious activity, especially if the service has privileged access or sits near other sensitive tooling.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Networks and Systems Monitored for Potential Cybersecurity Events | Actively exploited CVEs need continuous monitoring for suspicious activity. |
| RS.MA-01 — Incidents Are Mitigated | KEV-listed exploitation calls for prompt containment and mitigation. | |
| Recommendation — Monitor Teamserver logs and network activity for signs of exploitation. Contain the Teamserver exposure and apply vendor mitigation quickly. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | A KEV-listed vulnerability requires rapid remediation and verification. |
| SI-4 — System Monitoring | Exploitation checks depend on detecting abnormal Teamserver activity. | |
| Recommendation — Prioritise remediation of the vulnerable Teamserver component. Review alerts and logs for exploitation indicators on the Teamserver. | ||
| OWASP ASVS | V3 — Web Frontend Security | XSS is a web frontend security failure affecting browser-interpreted input. |
| Recommendation — Validate output handling and browser-facing controls around the Teamserver UI. | ||
Practitioner Guidance
What to verify: Confirm whether any Teamserver instance is reachable from untrusted networks, whether the vulnerable interface is in use, and whether logs show anomalous configuration activity, malformed usernames, or unexpected operator actions around the KEV publication date.
Escalation / exception: Treat exposure on an internet-facing or broadly reachable Teamserver as urgent. If you must defer remediation, document the exception, restrict reachability immediately, and increase monitoring until the vendor fix or mitigation is applied.
Practitioner takeaway: For an actively exploited CVE, the decision point is not whether exploitation is likely in the abstract, but whether your deployment is reachable, instrumented, and ready to assume compromise until proven otherwise.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- How do you patch or mitigate CVE-2022-39197 (Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS))?
- CVE-2022-39197 (Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS))
- Is CVE-2022-27926 (Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)) being exploited in the wild?
- Is CVE-2024-11182 (MDaemon Email Server Cross-Site Scripting (XSS)) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org