Is CVE-2022-26522 actively exploited?

Yes. CVE-2022-26522 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-26522 be exploited remotely?

No. CVE-2022-26522 requires local access to exploit.

What is the CVSS score of CVE-2022-26522?

CVE-2022-26522 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2022-26522

HIGHCISA KEVIN THE WILD

CVE-2022-26522

Published: April 11, 2026· Updated: May 8, 2026

7.8

CVSS v3.1

Official Description

The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xc4a3.

NVD Source

Risk Analysis

This high-severity vulnerability (CVSS 7.8) in Avast and AVG Windows Anti Rootkit driver (aswArPot.sys before 22.1) allows a local attacker to execute arbitrary code in kernel mode or cause a denial of service. The flaw stems from a double fetch vulnerability. Its active exploitation in the wild and inclusion in CISA's KEV catalog make it an urgent threat, as it could lead to full system compromise or crashes.

This vulnerability is actively exploited in the wild and is included in CISA's Known Exploited Vulnerabilities Catalog, indicating a critical threat, despite requiring local access.

Recommended Action

Update Avast and AVG Windows Anti Rootkit drivers to version 22.1 or newer immediately. Ensure all endpoint protection software is kept up-to-date to mitigate such kernel-level vulnerabilities.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-26522 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

CISA has added CVE-2022-26522 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.