Bitrix Site Manager - RCE (CVE-2022-27228)
Description
In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.
psychologyCrowdSec Analysis
CVE-2022-27228 is a critical remote code execution vulnerability in the vote module of Bitrix Site Manager before version 21.0.100. This flaw allows unauthenticated attackers to execute arbitrary code on the affected system, potentially leading to full system compromise and enabling a wide range of attacks, including data theft and service disruption.
CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2022-27228 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the Bitrix Site Manager by sending crafted POST requests to /bitrix/tools/vote/uf.php with specific parameters and multipart form data, enabling unauthenticated remote code execution via the vote module.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-03-22 |
| Rule Released | 2026-01-21 |
| CrowdSec First Seen | 2026-03-31 |