n/a SaltStack Salt

Name: n/a SaltStack Salt
Brand: n/a

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

critical

by severity

0critical5high1medium1low

updated 2026-10-28

vulnerabilities (7)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-21996US	high7.5	3.51% (89th)	—	no fix	2021-09-08	≤ Saltstack Salt (before 3003.3)
CVE-2022-22967US	high8.8OT elevated	2.06% (81st)	—	no fix	2022-06-23	≤ SaltStack Salt prior to 3002.9, 3003.5, 3004.2
CVE-2022-22935US	low3.7	1.62% (76th)	—	no fix	2022-03-29	≤ SaltStack Salt prior to 3002.8, 3003.4, 3004.1
CVE-2022-22941US	high8.8	1.34% (71st)	—	no fix	2022-03-29	≤ SaltStack Salt prior to 3002.8, 3003.4, 3004.1
CVE-2022-22934US	high8.8	0.88% (59th)	—	no fix	2022-03-29	≤ SaltStack Salt prior to 3002.8, 3003.4, 3004.1
CVE-2022-22936US	high8.8OT elevated	0.83% (57th)	—	no fix	2022-03-29	≤ SaltStack Salt prior to 3002.8, 3003.4, 3004.1
CVE-2021-22004US	medium6.4	0.35% (29th)	—	no fix	2021-09-08	≤ Saltstack Salt (before 3003.3)

The flaw types (CWEs) most of these CVEs share.

CWE-287Improper Authentication2 CVEs
CWE-285Improper Authorization1 CVEs
CWE-294Authentication Bypass by Capture-replay1 CVEs
CWE-347Improper Verification of Cryptographic Signature1 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1 CVEs
CWE-668Exposure of Resource to Wrong Sphere1 CVEs
CWE-732Incorrect Permission Assignment for Critical Resource1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.