---
id: "CVE-2022-42948"
kind: "vulnerability"
aliases: ["CVE-2022-42948"]
title: "helpsystems cobalt strike: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Fortra Cobalt Strike", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "helpsystems cobalt strike", "fixed": [], "affected": "= 4.7.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cobalt-strike", "exploited", "java", "package"]
not_affected_if: ["unknown"]
published_at: "2023-03-24T14:15:09+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42948", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42948", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# helpsystems cobalt strike: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components

Fortra Cobalt Strike's user interface has a flaw in its Java Swing code that allows remote code execution. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fortra Cobalt Strike affected ? fixed ?
- vendor:helpsystems cobalt strike affected = 4.7.1 fixed ?

## Fix

Apply the vendor update per Fortra's instructions; the sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42948
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-42948

## From the sources

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_