Lock WARP switch bypass on WARP mobile client using iOS quick action
Priority LOW 33CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed WARP (Cloudflare): 6.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | WARP | before 6.14 | 6.14 | Patch available | CNA |
- WARP VendorCloudflare Affected before 6.14 Fixed in 6.14 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:* | before 6.14 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:* Versions before 6.14 Vulnerable ·Cloudflare
Remediation
- Fix · CNA WARP (Cloudflare) Fixed in 6.14
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Cloudflare WARP 6.14
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-03069 Lock WARP switch feature bypass on WARP mobile client for iOSPriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3322
References
More Cloudflare Warp Mobile Client vulnerabilities
- TI-2022-03084 Lock WARP switch bypass by removing VPN profile on iOS mobile client CVSS 3.1HIGH 8.5
- TI-2022-03069 Lock WARP switch feature bypass on WARP mobile client for iOS CVSS 3.1HIGH 8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences