{"id":"CVE-2022-31199","published":"2022-11-08T01:15:09Z","modified":"2026-06-17T04:45:01Z","title":"Netwrix Auditor Insecure Object Deserialization Vulnerability","vendor":"Netwrix","product":"Auditor","tier":"core","eol":null,"description":{"text":"Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.","provenance":"source","from":"NVD"},"summary":{"text":"Netwrix Auditor contains a remote code execution flaw in the User Activity Video Recording component, affecting both the Auditor server and the agents installed on monitored systems, stemming from weaknesses in the underlying protocol the component uses. An unauthenticated remote attacker with network access can exploit it, without user interaction, to run arbitrary code as NT AUTHORITY\\SYSTEM on affected systems, including monitored hosts.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.36009,"percentile":0.98468,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-07-11","dueDate":"2023-08-01","ransomware":true,"requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"Patch application requires login to customer portal: https://security.netwrix.com/Account/SignIn?ReturnUrl=%2FAdvisories%2FADV-2022-003;  https://nvd.nist.gov/vuln/detail/CVE-2022-31199","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-12-08","exploitedFirstSeen":"2022-12-08","ransomware":true,"evidence":[{"url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","date":"2022-12-08"},{"url":"https://heimdalsecurity.com/blog/clop-ransomware-uses-viral-truebot-malware-to-access-networks/","date":"2022-12-12"},{"url":"https://cisa.gov/news-events/alerts/2023/07/06/cisa-and-partners-release-joint-cybersecurity-advisory-newly-identified-truebot-malware-variants","date":"2023-07-06"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-187a","date":"2023-07-06"},{"url":"https://www.cisa.gov/news-events/alerts/2023/07/06/cisa-and-partners-release-joint-cybersecurity-advisory-newly-identified-truebot-malware-variants","date":"2023-07-06"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-07-11"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/2023-top-routinely-exploited-vulnerabilities","date":"2024-11-13"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://bishopfox.com/blog/netwrix-auditor-advisory","tags":["Exploit","Third Party Advisory"]},{"url":"https://bishopfox.com/blog/netwrix-auditor-advisory","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-31199","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of network-exposed component","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"potentially allow an unauthenticated remote attacker to execute arbitrary code","start":298,"end":376}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution as SYSTEM","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary code as the NT AUTHORITY\\SYSTEM user","start":354,"end":408}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-29d0b86e8592bf01f10c","title":"Breaking the silence","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","date":"2022-12-08","mentions":[{"quote":"Netwrix vulnerability (CVE-2022-31199) based delivery","start":3778,"end":3831},{"quote":"Because multiple of these events occurred in the same timeframe on unrelated organizations, we believe with high confidence that these events are the result of the exploitation of a vulnerability in Netwrix Auditor (CVE-2022-31199) that was made public in July 2022 by Bishop Fox.","start":4522,"end":4802}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-53293","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53293","exploited":true,"exploitedSince":"2023-07-11","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://bishopfox.com/blog/netwrix-auditor-advisory"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2022-11-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31199","provenance":"source"},{"date":"2022-12-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","provenance":"source"},{"date":"2022-12-08","kind":"report","label":"Named in blog.talosintelligence.com: Breaking the silence","url":"https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/","provenance":"machine"},{"date":"2023-07-11","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-07-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53293","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":245},"priority":{"score":83.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1421 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.69,"detail":"percentile 0.9847"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}