CVE-2022-2225: Cloudflare WARP

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.

Affected products

• Cloudflare WARP: before 2022.5.227.0 (fixed in 2022.5.227.0); before 2022.5.341.0 (fixed in 2022.5.341.0); before 2022.5.346 (fixed in 2022.5.346)

Published 2022-07-26. Last modified 2026-06-17.