Is CVE-2022-42948 (Fortra Cobalt Strike User Interface Remote Code Execution) being exploited in the wild?

What it means to be exploited in the wild

For this CVE, “exploited in the wild” means the vulnerability is not just theoretical or lab-reproduced. CISA’s KEV listing is the key confirmation signal, because it is reserved for flaws with reliable evidence of active exploitation. That makes this a live exposure issue, not a purely academic product defect, and it raises the urgency of scoping every reachable installation.

Because the product is tied to remote code execution, the practical question is not only whether the software exists in your estate, but whether any instance can still be reached by the interfaces or workflows the product exposes. If you cannot confidently prove that no susceptible instance is present, you should assume the answer is yes until inventory and validation say otherwise.

For further triage guidance, use the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database as the authoritative sources for record context and product-specific references.

How to confirm exposure and reduce attack surface

Start by identifying every deployment of the affected Cobalt Strike User Interface, including test, internal, and forgotten instances. The most common failure is partial inventory, where one surviving server or management endpoint remains reachable after teams assume the product is gone. If any instance is still in service, treat it as internet-facing or internally reachable until proven otherwise.

Containment should focus on removing unnecessary access paths first, then applying the vendor fix or other approved mitigation as soon as possible. If patching must wait, isolate the host, restrict network reachability, and disable any exposed path that allows an attacker to interact with the vulnerable interface. Do not rely on obscurity or assumed low usage as a control.

The original product entry, vulnerability record, and remediation references should be checked directly rather than inferred from secondary writeups. The CVE Program is the authoritative place to anchor the identifier, while the vendor advisory should be used for version and fix details that are not appropriate to restate from memory.

What to do if patching has to wait

If immediate remediation is blocked by change control, compatibility testing, or operational dependency, shift to compensating controls that reduce exploitability rather than merely documenting the exception. For a remote code execution issue, that usually means narrowing who can reach the interface, reducing the privilege of the underlying service account, and ensuring the host is monitored closely enough to spot suspicious child processes, file writes, or outbound connections.

Because KEV-listed flaws already have evidence of active exploitation, delay changes the risk profile. Every extra day of exposure matters more than the paperwork around the exception, so exception handling should have a short expiry, an explicit owner, and a clear decision on whether the system stays in service at all.

After remediation, do not stop at “patched.” Verify whether the host showed signs of compromise before the fix, especially if the system was reachable during the exposure window or if logs are incomplete. Where you find strong indicators of prior abuse, rotate any credentials, tokens, or service material that the system could have exposed or used to pivot further.

Risk and Threat Considerations

This is a live exploitation risk, not just a vulnerability management task. Remote code execution on a security tool or operator-facing interface can give an attacker a foothold with high leverage, especially if the system is trusted by administrators or sits near sensitive infrastructure.

Failure mechanism: The attacker abuses the vulnerable interface to execute code on the host, then uses that host as an internal pivot point, a persistence point, or a launch point for further reconnaissance and lateral movement.

Impact: Successful exploitation can expose adjacent systems, credentials, or operational tooling, and it can convert a single software flaw into broader environment compromise.

Practitioner Guidance

What to verify: Confirm every installed instance, the exact exposure path, and whether any logs cover the exploitation window. If logging is incomplete, treat the inability to prove clean status as a security finding, not an administrative gap.

Decision rule: If the product is still deployed and reachable, prioritize remediation before routine maintenance work. If you cannot remediate immediately, narrow access and raise the issue to the owner who can accept the operational risk, not just the local administrator.

What good looks like: You should be able to show that the vulnerable interface is removed, patched, or effectively isolated, and that the host was checked for compromise before returning to normal service.

Practitioner takeaway: For KEV-listed remote code execution flaws, the right question is not whether exploitation is possible in theory, but whether any reachable instance remains exposed long enough for attackers to use it.

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• How do you patch or mitigate CVE-2022-42948 (Fortra Cobalt Strike User Interface Remote Code Execution)?
• CVE-2022-42948 (Fortra Cobalt Strike User Interface Remote Code Execution)
• Is CVE-2020-5902 (F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution) being exploited in the wild?
• Is CVE-2022-26501 (Veeam Backup & Replication Remote Code Execution) being exploited in the wild?