Cobalt vulnerabilities (CVEs)

99 CVEs matched to Cobalt by name in NVD, 2 on CISA's Known Exploited list.

Back to the Cobalt profile · Alternatives to Cobalt · CVE RSS feed

Exploitation riskConfirmed exploited

99 of 99 CVEs assessed

confirmed exploited

past CISA deadline

EPSS ≥ 10%

>99%

highest single CVE

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2022-42948 ↗⚠ exploitedoverdueEPSS 2.7%LEV ≥70%Confirmed exploited
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely e…
CVE-2022-39197 ↗⚠ exploitedoverdueEPSS 46%LEV ≥>99%Confirmed exploited
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Stri…
↗

Recent changes

last 90 days

CVE-2023-44437 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-12 · NVD ↗
CVE-2023-35713 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2001-1408 is now estimated at a 100% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2023-34287 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2023-34310 is now estimated at a 11% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Unscored	Total
2025	0	37	1	0	0	38
2024	0	38	1	0	1	40
2023	1	1	0	0	0	2
2022	0	0	1	0	0	1
2021	0	1	0	0	0	1
2018	0	0	1	0	0	1
2009	0	2	0	0	0	2
2002	0	4	1	1	0	6
2001	0	0	2	0	0	2
2000	0	2	1	0	0	3
1999	0	2	0	1	0	3

On CISA's Known Exploited Vulnerabilities list

2 of 99 matched CVEs are listed. 2 are past the remediation due date CISA set.

Most recent additions

CVE-2022-39197 added 2023-03-30
CVE-2022-42948 added 2023-03-30

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2022-39197	46%	99%
CVE-2002-1361	12%	96%
CVE-2001-1408	8.1%	95%
CVE-2002-0348	7.7%	95%
CVE-2000-0234	7.3%	94%
CVE-2002-0346	6.5%	94%
CVE-2002-0347	5.6%	93%
CVE-2002-1058	4.4%	91%
CVE-2021-36798	4.3%	91%
CVE-2001-1075	2.7%	86%

Known CVEs (99)

RSS ⇢

CVE-2025-8003 ↗HIGH 7.82025
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Ve…
CVE-2025-8002 ↗HIGH 7.82025
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum…
↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Cobalt by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-08-14.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.