Lock WARP switch bypass on WARP mobile client using iOS quick action

published 2022-10-28 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-42712

cvss: 6.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits: 0; none known

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.

Patch / fix

fixed in 1

Cloudflare WARP 6.14

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-05-05)

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Cloudflare WARP

Classification

Weakness

CWE-862 Missing Authorization
CWE-347 Improper Verification of Cryptographic Signature

References

github.com /cloudflare/advisories/security/advisories/GHSA-76pg-rp9h-wmcj
third-party-advisory

Sources

CVE List CVE-2022-3322
NVD CVE-2022-3322

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary