CISA KEVRansomware Use Known

CVE-2022-36537

ZK Framework AuUploader Unspecified Vulnerability

ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.

VendorZK Framework

ProductAuUploader

EPSS95.3%

Added to KEVFeb 27, 2023

Remediation DueMar 20, 2023

Known Ransomware UseYes

CWECWE-441

Required Action

Apply updates per vendor instructions.

From Disclosure to Action

Know how quickly you need to move.

For CVE-2022-36537, added to the catalogue on Feb 27, 2023 with a remediation deadline of Mar 20, 2023.

Added to KEVFeb 27, 2023

Seraph AlertSame day

Remediation DueMar 20, 2023

ValidationOngoing

Overdue1318 days overdue

Recommended action: Apply vendor remediation guidance.

Seraph Context

Technology Watch Match

Available for technologies you monitor inside Seraph CTI.

Relevant Threat Actors

Surfaced automatically when a tracked actor is linked to this CVE.

Sector Context

Shown when this vendor/product is relevant to your industry.

Exploitation Context

Campaign and indicator context, where Seraph analysts have published it.

References

Does this affect technology you run?

Declare your technology stack inside Seraph CTI and get notified the moment a KEV entry matches it.

Explore Seraph CTI Back to KEV Catalogue