Skyhigh SWG Authentication bypass vulnerability

published 2022-07-27 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-34580

cvss: 10.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 0; none known

An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.

Patch / fix

fixed in 1

Skyhigh Security Skyhigh Secure Web Gateway (SWG) 8.2.28, 9.2.23, 10.2.12, 11.2.1

Exploit prediction

1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Skyhigh Security Skyhigh Secure Web Gateway (SWG)

Classification

Weakness

CWE-290 Authentication Bypass by Spoofing

References

kcm.trellix.com /corporate/index?page=content&id=SB10384&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&loca
vendor-advisory

Sources

CVE List CVE-2022-2310
NVD CVE-2022-2310

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary