Netwrix Auditor Remote Code Execution (RCE) Vulnerability Advisory (CVE-2022-31199)
Executive & SecOps Summary
SECOPS ASSESSMENTNetwrix Auditor server and User Activity Video Recording agents installed on monitored systems
Unauthenticated remote attackers can execute arbitrary code with 'NT AUTHORITY\SYSTEM' privileges on affected servers and monitored hosts
Immediately upgrade Netwrix Auditor to the latest secure version and restrict network access to agent communication ports
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Download and apply the latest secure version (10.5 or higher) from the Netwrix Support Portal. To verify the currently installed version of Netwrix Auditor and its services via PowerShell, execute the following commands:
# Check installed Netwrix Auditor version and service status
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*Netwrix*' } | Select-Object Name, Version
Get-Service -Name *Netwrix* | Select-Object Name, Status, StartType2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict inbound network access to the Netwrix Auditor and Video Recording agent ports using Windows Defender Firewall. Only allow trusted administrative subnets or specific server IPs to communicate with these ports:
# Block unauthorized inbound traffic to the Netwrix Agent port (e.g., TCP 9004)
New-NetFirewallRule -DisplayName 'Block Unauthorized Netwrix Agent Access' `
-Direction Inbound `
-Action Block `
-Protocol TCP `
-LocalPort 9004
# Restrict access to a trusted management subnet only
Set-NetFirewallRule -DisplayName 'Block Unauthorized Netwrix Agent Access' `
-RemoteAddress '192.168.10.0/24' `
-Action Allow3. Log Audit & IoC Verification Commands
Monitor Windows Event Logs and process creation events for anomalous child processes spawned by Netwrix services (e.g., Netwrix.UAV.Agent.exe spawning cmd.exe or powershell.exe). Use the following PowerShell script to audit process lineage:
# Audit suspicious child processes spawned by Netwrix services
Get-CimInstance Win32_Process | Where-Object {
$_.ParentProcessId -in (Get-Process -Name *Netwrix* -ErrorAction SilentlyContinue).Id
} | Select-Object ProcessId, Name, CommandLine, CreationDate | Format-Table -AutoSizeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-31199) is a critical remote code execution (RCE) flaw in the 'User Activity Video Recording' component of Netwrix Auditor. The root cause lies in the insecure deserialization of untrusted data (CWE-502) within the underlying communication protocol used between the Netwrix Auditor server and its agents. Due to a lack of strict input validation and safe deserialization controls, the application attempts to deserialize arbitrary object streams sent by remote entities, leading to code execution.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by establishing a direct TCP connection to the listening port of the Netwrix Auditor server or agent. By sending a specially crafted serialized .NET payload containing malicious gadget chains (such as ObjectDataProvider), the attacker triggers the deserialization process on the target system. Since this process runs automatically upon receiving the payload without requiring any authentication or user interaction, it allows reliable, unauthenticated remote code execution.
3. Infrastructure & Business Impact
Netwrix Auditor is heavily integrated into enterprise environments to monitor Active Directory, file servers, and databases. Successful exploitation grants the attacker 'NT AUTHORITY\SYSTEM' privileges—the highest level of access on Windows systems. This allows attackers to compromise domain controllers, deploy ransomware, and exfiltrate sensitive corporate data. Given its inclusion in the CISA KEV catalog, active exploitation in the wild has been confirmed, making this a high-priority threat to enterprise infrastructure.
Official Vendor Advisories & References
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
Frequently Asked SecOps Questions (CVE-2022-31199)
FAQQ1. How critical is CVE-2022-31199 and is it actively exploited in the wild?
CVE-2022-31199 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 36.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-31199?
Primary impacted vendors include netwrix across auditor. Scope summary: Netwrix Auditor versions prior to 10.5 (with User Activity Video Recording component enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2022-31199 before patching?
[Mitigation] Immediately upgrade Netwrix Auditor to the latest secure version and restrict network access to agent communication ports Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-31199
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (netwrix)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.