Live › vulnerability › CVE-2022-31199
Go to dashboardNetwrix Auditor's User Activity Video Recording component deserializes untrusted objects insecurely, letting an unauthenticated remote attacker reach port 9004/TCP. A successful attack runs code as NT AUTHORITY\SYSTEM on the Windows host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| netwrix auditor | vendor | < 10.5 | 10.5 |
| Netwrix Auditor | vendor | – | – |
Confirm whether the User Activity Video Recording component is installed and whether TCP port 9004 is reachable from untrusted networks.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.
CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2022-31199")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.