CVE-2022-31199: Netwrix Auditor Insecure Object Deserialization Vulnerability

CVE-2022-31199 is an insecure object deserialization flaw in the User Activity Video Recording component of Netwrix Auditor. An unauthenticated remote attacker who can reach the service can execute code with NT AUTHORITY\SYSTEM privileges. The issue has been used by ransomware operators, so organizations running this product should treat it as high priority and confirm details against the vendor advisory.

Because the vulnerability grants full system-level control, successful exploitation can lead to complete host compromise, lateral movement, and data theft or encryption. Port 9004/TCP must be reachable for the attack to succeed; that port is often blocked by default enterprise firewall rules, which reduces exposure for many deployments.

How it works

The root weakness is CWE-502 (Deserialization of Untrusted Data), with an associated memory-safety issue under CWE-122. Insecure deserialization occurs when an application reconstructs objects from data supplied by an untrusted source without sufficient validation. An attacker crafts a malicious serialized payload that, when processed by the User Activity Video Recording component, causes the application to instantiate attacker-controlled objects and execute arbitrary code.

Because the process runs as NT AUTHORITY\SYSTEM, the resulting code execution inherits the highest local privileges on a Windows host. Exploitation is remote and unauthenticated, but it requires network access to port 9004/TCP. No further exploit mechanics are detailed in public summaries; defenders should treat any unsolicited traffic to that port as suspicious and verify exact attack surface details in the vendor advisory.

Am I affected? How to find it in your systems

Netwrix Auditor is typically deployed on Windows servers that perform auditing, change tracking, and user-activity recording across Active Directory, file systems, and other enterprise assets. The vulnerable component is the User Activity Video Recording service.

• Inventory all hosts that have Netwrix Auditor installed. Check installed programs lists, software inventory tools (SCCM, Intune, etc.), and service control managers for the Netwrix Auditor services.
• Confirm whether the User Activity Video Recording feature is enabled and listening. Look for a process or service bound to TCP port 9004.
• Review firewall and network segmentation rules to determine whether port 9004/TCP is reachable from untrusted networks or from broad internal segments.
• Examine application and system logs for unexpected connections to port 9004, deserialization-related exceptions, or sudden process creation under the SYSTEM account originating from the Netwrix service.

Exact affected versions and configurations must be confirmed against the vendor advisory; do not rely solely on version strings found in public summaries.

How to remediate

Apply the vendor-supplied updates for Netwrix Auditor as directed in the official advisory. CISA’s required action is to apply those updates or discontinue use of the product if updates are unavailable. After patching, restart the affected services and verify that the User Activity Video Recording component no longer accepts untrusted serialized input.

• Validate the patch installation by checking the updated file versions or service build numbers against the advisory.
• If the product is no longer needed, uninstall it completely and remove residual services and listening ports.
• Harden remaining instances by ensuring the service runs with least privilege where possible and that only authorized management stations can reach port 9004.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls.

• Block inbound access to TCP port 9004 at the host firewall and at network perimeter or segmentation firewalls. Restrict the port to a small set of trusted management hosts if the feature must remain available.
• Place the Netwrix Auditor host in a tightly controlled network segment with strict egress filtering to limit post-exploitation movement.
• If a web application firewall or network IPS is in the path, enable any available signatures or virtual-patch rules for insecure deserialization or for traffic patterns associated with this product; confirm coverage with the security vendor.
• Disable the User Activity Video Recording component if business requirements allow it; this removes the vulnerable code path.
• Increase monitoring: alert on any connection attempts to port 9004, on process creation by the Netwrix service, and on anomalous SYSTEM-level activity. Retain full packet captures of any traffic to the port for later analysis.

If your data may have been exposed

Actively exploited vulnerabilities of this class frequently lead to ransomware deployment and data exfiltration. If you have evidence of successful exploitation or if the host was reachable on port 9004 from untrusted networks, assume compromise, isolate the system, and begin incident response. You can run a free exposure scan of your email addresses to check whether associated credentials or personal data already appear in known breach collections.