Unquoted Service Path in Cloudflare WARP for Windows
Priority LOW 34CWE-428Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-428.
Summary
Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0.
Why it matters now
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed WARP (Cloudflare): 2022.3.186.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | WARP | 2022.2.95.0 and later; before 2022.3.186.0 | 2022.3.186.0 | Patch available | CNA |
- WARP VendorCloudflare Affected 2022.2.95.0 and later; before 2022.3.186.0 Fixed in 2022.3.186.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:* | 2022.2.95.0 to before 2022.3.186.0 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:warp:*:*:*:*:*:windows:*:* Versions 2022.2.95.0 to before 2022.3.186.0 Vulnerable ·Cloudflare
Remediation
- Fix · CNA WARP (Cloudflare) Fixed in 2022.3.186.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2147
- 2026-10-03 Alias added: GHSA-frq6-c9vg-hmxj
References
More Cloudflare Warp vulnerabilities
- TI-2022-04046 support_uri validation missing in WARP client for Windows CVSS 3.1HIGH 8.9
- TI-2022-03068 Bypassing Cloudflare Zero Trust policies using warp-cli set-custom-endpoint command CVSS 3.1CRITICAL 9.8
- TI-2023-01749 Remote access to warp-svc.exe in Cloudflare WARP CVSS 3.1HIGH 7.3
- TI-2022-03240 Lock WARP switch bypass using warp-cli 'add-trusted-ssid' command CVSS 3.1HIGH 8.8
- TI-2023-02579 Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client CVSS 3.1HIGH 7.4
- TI-2023-01335 Local Privilege Escalation Vulnerability in WARP's MSI Installer CVSS 3.1HIGH 7.8
Sources
- CVE-2022-2147 · CVE Program
- CVE-2022-2147 · NVD
- FIRST EPSS
- GHSA-frq6-c9vg-hmxj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences