WaratekVRT Sign in

CVE-2022-36537 ZK Framework

Affected softwareZK Framework
Severity7.5 High CVSS 3.1 2 scores
Fixed in8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, 9.6.2
WeaknessInformation exposure (CWE-200)
Published26 Aug 2022
Updated17 Jun 2026

Description

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2023-02-27 · remediation due 2023-03-20 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 8 citations · 3 exploits · earliest 2023-02-14.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2022-12-09.
  • EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-36537 in VulnCheck (free account), which lists 3 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation info.securin.io /hubfs/Securin%20Ransomware%20Report%202023.pdf 2023-02-14
Reported exploitation blog.fox-it.com /2023/02/22/from-backup-to-backdoor-exploitation-of-cve-2022-36537-in-r1soft-server-backup-manager 2023-02-22
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2023-02-27
Reported exploitation rapid7.com /blog/post/2023/03/01/etr-active-exploitation-of-zk-framework-cve-2022-36537 2023-03-01
Reported exploitation fortinet.com /blog/threat-research/lockbit-most-prevalent-ransomware 2023-07-10
Exploit reference VulnCheck XDB 0508bf2f3fce Exploit type: initial-access 2022-12-09
Exploit reference VulnCheck XDB 5ba33e292bd5 Exploit type: initial-access 2023-05-25
Exploit reference VulnCheck XDB 4492cc4717e5 Exploit type: initial-access 2025-09-28
IndexArtifactStarsFirst seen
GitHub PoC POC of CVE-2022-36537 36 2022-12-09
GitHub PoC CVE-2022-36537 9 2022-12-09
Nuclei ZK Framework - Information Disclosure

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.zkoss.zk:zk), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CISA-ADP Secondary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.zkoss.zk:zk 0 8.6.4.2 unbounded
org.zkoss.zk:zk 9.0.0.0 9.0.1.3 unbounded
org.zkoss.zk:zk 9.5.0.0 9.5.1.4 unbounded
org.zkoss.zk:zk 9.6.0.0 9.6.0.2 unbounded
org.zkoss.zk:zk 9.6.1 9.6.2 unbounded

Products and versions

2 products, 9 version entries
SourceVendorProductSchemeAffected versions
osv org.zkoss.zk zk generic ＜ 8.6.4.2 · ≥ 9.0.0.0 and ＜ 9.0.1.3 · ≥ 9.5.0.0 and ＜ 9.5.1.4 · ≥ 9.6.0.0 and ＜ 9.6.0.2 · ≥ 9.6.1 and ＜ 9.6.2
nvd zkoss zk framework generic ＜ 8.6.4.2 · ≥ 9.0.0 and ＜ 9.0.1.3 · ≥ 9.5.0 and ＜ 9.5.1.3 · ≥ 9.6.0 and ＜ 9.6.2

References

URLTags
https://github.com/zkoss/zk/commit/92a29aa9b1daf1fd2d9d188cb6545f0441d54e84 WEB
https://github.com/zkoss/zk PACKAGE
https://tracker.zkoss.org/browse/ZK-5150 WEB
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537 WEB
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ Third Party Advisory

Timeline
Published2022-08-26By the CVE Program.
VulnCheck KEV: earliest evidence2023-02-14Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2023-02-27Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2025-09-28Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.