# CVE-2022-27228: Bitrix Site Manager - RCE

> Live exploitation tracking for CVE-2022-27228 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-27228

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Bitrix24 Bitrix Site Manager
- **Weaknesses:** CWE-20 (Improper Input Validation)
- **Tags:** cms

## Description

In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.

## CrowdSec analysis

[CVE-2022-27228](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-27228) is a critical remote code execution vulnerability in the vote module of Bitrix Site Manager before version 21.0.100. This flaw allows unauthenticated attackers to execute arbitrary code on the affected system, potentially leading to full system compromise and enabling a wide range of attacks, including data theft and service disruption.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-27228 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the Bitrix Site Manager by sending crafted POST requests to `/bitrix/tools/vote/uf.php` with specific parameters and multipart form data, enabling unauthenticated remote code execution via the vote module.

## Timeline

- 2022-03-22: CVE Published. CVE-2022-27228 is published to NVD.
- 2026-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2022-27228 exploitation attempts against the CrowdSec Network.
- 2026-03-31: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-27228 for the first time.

## References

- https://helpdesk.bitrix24.com/open/15536776/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27228.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-27228) follows observed exploitation activity for CVE-2022-27228. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.