---
id: "CVE-2022-31199"
kind: "vulnerability"
aliases: ["CVE-2022-31199"]
title: "Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "netwrix auditor", "fixed": ["10.5"], "affected": "< 10.5", "ecosystem": "vendor"}, {"name": "Netwrix Auditor", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "netwrix-auditor", "ransomware", "vendor", "windows"]
not_affected_if: ["no-video-recording-component", "port-9004-blocked"]
published_at: "2022-11-08T01:15:09+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-31199", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31199", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting…

Netwrix Auditor's User Activity Video Recording component deserializes untrusted objects insecurely, letting an unauthenticated remote attacker reach port 9004/TCP. A successful attack runs code as NT AUTHORITY\SYSTEM on the Windows host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:netwrix auditor affected < 10.5 fixed 10.5
- vendor:Netwrix Auditor affected ? fixed ?

## How to check

Confirm whether the User Activity Video Recording component is installed and whether TCP port 9004 is reachable from untrusted networks.

## Fix

Apply the vendor update per Netwrix instructions, or stop using the product if no update is available (CISA required action).
Block inbound TCP 9004 at the firewall until patched.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-31199
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-31199

## From the sources

Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.

CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_