Lock WARP switch bypass by removing VPN profile on iOS mobile client
Priority LOW 37CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed WARP (Cloudflare): 6.15
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | WARP | before 6.15 | 6.15 | Patch available | CNA |
- WARP VendorCloudflare Affected before 6.15 Fixed in 6.15 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:* | before 6.15 | Vulnerable | Cloudflare |
- cpe:2.3:a:cloudflare:warp_mobile_client:*:*:*:*:*:iphone_os:*:* Versions before 6.15 Vulnerable ·Cloudflare
Remediation
- Fix · CNA WARP (Cloudflare) Fixed in 6.15
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3337
References
More Cloudflare Warp Mobile Client vulnerabilities
- TI-2022-03069 Lock WARP switch feature bypass on WARP mobile client for iOS CVSS 3.1HIGH 8.2
- TI-2022-03070 Lock WARP switch bypass on WARP mobile client using iOS quick action CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences