Is CVE-2022-28244 actively exploited?

No active exploitation of CVE-2022-28244 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-28244 be exploited remotely?

No. CVE-2022-28244 requires local access to exploit.

What is the CVSS score of CVE-2022-28244?

CVE-2022-28244 has a CVSS score of 6.3 (MEDIUM).

HOME VULNERABILITIESCVE-2022-28244

MEDIUM

CVE-2022-28244

CWE-657Published: May 11, 2022· Updated: Jun 17, 2026

6.3

CVSS v3.1

Official Description

Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a violation of secure design principles through bypassing the content security policy, which could result in an attacker sending arbitrarily configured requests to the cross-origin attack target domain. Exploitation requires user interaction in which the victim needs to access a crafted PDF file on an attacker's server.

NVD Source

Technical Analysis

CVE-2022-28244 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.