CVE-2022-31199

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

36.01% chance of exploitation in the next 30 days, 98th percentile

CISA KEV

added 2023-07-11, used in ransomware campaigns

Published

2022-11-08

Updated

2025-10-21

Proof-of-concept exploits (1)

• developerfred/CVE-2022-31199

References

• CVE Record
• NVD entry

Related

• CVE-2019-14206
• CVE-2022-31195
• CVE-2022-31201
• CVE-2022-31194
• CVE-2022-31202
• CVE-2022-31192