CVE-2022-2841

CrowdStrike Falcon Uninstallation authorization

2.7 LowPublic exploit

A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of the component Uninstallation Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.40.15409, 6.42.15611 and 6.44.15807 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-206880.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

5.00%Up 4.0 points since Aug 23, 2022

What each source reports

CVE List Score used 2.7

CrowdStrike Falcon Uninstallation authorization

Record: CVE-2022-2841
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0: 2.7 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2022-35075 2.7

Record: EUVD-2022-35075
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9vhv-pwq9-3j8p 2.7

A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610. It has been classified...

A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610. It has been classified as problematic. Affected is the Uninstallation Handler which makes it possible to circumvent and disable the security feature. The manipulation leads to missing authorization. The identifier of this vulnerability is VDB-206880.

Record: GHSA-9vhv-pwq9-3j8p
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 2.7

Record: CVE-2022-2841
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token	2023-03-30

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2841 is a low vulnerability (CVSS 2.7) in Asr Falcon, published August 22, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.00%, the 92nd percentile. No source names a fixed version.