← Vulnerability feed

Vulnerability record · CVE-2021-36798 · published 9 August 2021

CVE-2021-36798: Helpsystems cobalt strike allocation without limits vulnerability

Helpsystems · Cobalt Strike

A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 server thread and block beacons' communication with it.

7.5 CVSS 3.1 High EPSS 4.3% · top 9.2% CWE-770 · Allocation without limits
7.5CVSS 3.1 base score, v2 5.0
4.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. It allows remote attackers to crash the C2 server thread and block beacons' communication with it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://labs.sentinelone.com/hotcobalt-new-cobalt-strike-dos-vulnerability-that-lets-you-halt-operations/ ExploitThird Party Advisory
https://www.cobaltstrike.com/releasenotes.txt Release NotesVendor Advisory
https://labs.sentinelone.com/hotcobalt-new-cobalt-strike-dos-vulnerability-that-lets-you-halt-operations/ ExploitThird Party Advisory
https://www.cobaltstrike.com/releasenotes.txt Release NotesVendor Advisory

Track CVE-2021-36798 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-42948Cobalt Strike UI HTML injection leads to remote code executionCobalt Strike 4.7.1 fails to escape HTML tags rendered in its Swing UI components. Crafted HTML injected into that UI can execute code in the Cobalt …KEVEPSS 2.7%analysed6.1CVE-2022-39197Cobalt Strike Teamserver XSS via Malformed Payload Username FieldCobalt Strike through 4.7 contains a cross-site scripting flaw in the teamserver that lets a remote attacker inject HTML by modifying the username fi…KEVEPSS 46%analysed7.5CVE-2022-23317Helpsystems cobalt strike improper authentication vulnerabilityCobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by spec…EPSS 1.1%8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2021-36798), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.