Patch & vulnerability status
Cloudflare, Inc.
Cloudflare WARP 2024.2.68.0
Latest tracked version 2024.2.68.0. Release status, tracked CVEs, and automated cross-platform patching for Cloudflare WARP.
Category: VPN and Zero Trust
| Platform | Latest version | CVEs tracked | Last checked |
|---|---|---|---|
| Windows | 2024.2.68.0 | 9 | 2024-05-15 |
Known vulnerabilities (CVEs) in Cloudflare WARP
Lavawall tracks 9 published CVEs affecting Cloudflare WARP, and deploys the versions that fix them automatically across your fleet.
| CVE | Published | Severity | Details | Vector |
|---|---|---|---|---|
| CVE-2025-0651 | 2025-01-22 18:15:20 | HIGH (7) | Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user. This issue affects WARP: before 2024.12.492.0. | LOCAL |
| CVE-2023-2754 | 2023-08-03 15:15:23 | MEDIUM (7) | The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that performs DNS queries in a secure manner, however, if a user is connected to WARP over an IPv6-capable network, te WARP client did not assign loopback IPv6 addresses but Unique Local Addresses, which under certain conditions could point towards unknown devices in the same local network which enables an Attacker to view DNS queries made by the device. | NETWORK |
| CVE-2023-1862 | 2023-06-20 09:15:09 | HIGH (7) | Cloudflare WARP client for Windows (up to v2023.3.381.0) allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining network diagnostics and application configuration from the target's device. It is important to note that in order to exploit this, a set of requirements would need to be met, such as the target's device must've been reachable on port 445, allowed authentication with NULL sessions or otherwise having knowledge of the target's credentials. | NETWORK |
| CVE-2023-1412 | 2023-04-05 16:15:07 | HIGH (8) | An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.582.0) to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks (oplock) and symbolic links (which can both be created by an unprivileged user). After installing the Cloudflare WARP Client (admin privileges required), an MSI-Installer is placed under C:\Windows\Installer. The vulnerability lies in the repair function of this MSI. ImpactAn unprivileged (non-admin) user can exploit this vulnerability to perform privileged operations with SYSTEM context, including deleting arbitrary files and reading arbitrary file content. This can lead to a variety of attacks, including the manipulation of system files and privilege escalation. PatchesA new installer with a fix that addresses this vulnerability was released in version 2023.3.381.0. While the WARP Client itself is not vulnerable (only the installer), users are encouraged to upgrade to the latest version and delete any older installers present in their systems. | LOCAL |
| CVE-2023-0652 | 2023-04-06 10:15:07 | HIGH (8) | Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer (MSI) of WARP Client for Windows (<= 2022.12.582.0) allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As Cloudflare WARP client for Windows (up to version 2022.5.309.0) allowed creation of mount points from its ProgramData folder, during installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files. | LOCAL |
| CVE-2022-4428 | 2023-01-11 17:15:09 | HIGH (9) | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients). | NETWORK |
| CVE-2022-2147 | 2022-06-23 21:15:08 | MEDIUM (8) | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0. | LOCAL |
| CVE-2022-2145 | 2022-06-28 18:15:08 | MEDIUM (8) | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files. | LOCAL |
| CVE-2020-35152 | 2021-02-03 00:15:15 | MEDIUM (8) | Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges can become an administrator by abusing the unquoted service path issue. Since version 1.2.2695.1, the vulnerability was fixed by adding quotes around the service's binary path. This issue affects Cloudflare WARP for Windows, versions prior to 1.2.2695.1. | LOCAL |
Why keeping Cloudflare WARP patched matters
Unpatched third-party applications are one of the most common ways attackers get in: 57% of breached MSP clients and 32% of ransomware cases trace back to a missing patch. Every Cloudflare WARP release that fixes a security bug is public, so attackers see it too, and an out-of-date install becomes a documented way in. Tracking the installed version on every machine and closing the gap quickly is what turns a disclosed CVE into a non-event.
How Lavawall® patches Cloudflare WARP
Lavawall® watches Cloudflare WARP releases and CVEs continuously, ranks each update by risk, and deploys it across your whole fleet, Windows, macOS, and Linux, from a single agent, independently of your RMM. You get one place to see which machines are behind on Cloudflare WARP, one policy to bring them current, and timestamped evidence for audits.
Frequently asked questions
What is the latest version of Cloudflare WARP?
Lavawall tracks Cloudflare WARP at version 2024.2.68.0 (last checked 2024-05-15). New releases are monitored continuously and can be deployed automatically across your fleet.
Lavawall tracks Cloudflare WARP at version 2024.2.68.0 (last checked 2024-05-15). New releases are monitored continuously and can be deployed automatically across your fleet.
Does Cloudflare WARP have known security vulnerabilities (CVEs)?
Lavawall tracks 9 CVEs for Cloudflare WARP and remediates them automatically as part of patching.
Lavawall tracks 9 CVEs for Cloudflare WARP and remediates them automatically as part of patching.
How do I patch Cloudflare WARP automatically?
Deploy the Lavawall® agent and Cloudflare WARP updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Deploy the Lavawall® agent and Cloudflare WARP updates are applied automatically across Windows, macOS, and Linux, risk-ranked and reported, independently of your RMM.
Lavawall® monitors releases and CVEs for Cloudflare WARP through public information and proprietary statistical analysis, and can patch it automatically across your fleet.