Fact-checked by Grok 2 weeks ago

COMSPEC

COMSPEC is an environment variable in Microsoft operating systems, including MS-DOS, OS/2, and Windows, that specifies the full path to the system's command line interpreter executable. In MS-DOS and Windows 9x, it typically points to COMMAND.COM, while in OS/2 and Windows NT-based systems, it defaults to cmd.exe (or %SystemRoot%\system32\cmd.exe in Windows). This variable is essential for the operating system to locate and execute the default shell for running commands, batch files, and scripts. The variable's value is established during system installation or boot process; in MS-DOS and Windows 95/98, it is set via the SHELL directive in CONFIG.SYS, providing the absolute path to the command interpreter. In modern Windows environments, COMSPEC is a system-wide environment variable that inherits to child processes, ensuring consistent access to the command processor across applications and subsystems. It plays a critical role in commands like start, where it prevents the execution of potentially malicious cmd.exe files from the current directory by substituting the verified path from COMSPEC. COMSPEC also facilitates in development and tools, such as when launching command-line processes in programming environments or during software installations that rely on the default . Altering its value can lead to system instability, as seen in errors during application setups like , where an incorrect path disrupts command execution. While primarily a system-managed , users can modify it through the Variables interface, though this is rarely recommended outside of advanced .

Overview

Definition

In and , COMSPEC is an that specifies the full path to the executable file for the secondary command line interpreter, distinguishing it from the primary interpreter loaded at system startup via the SHELL directive in , which remains resident in memory to handle core OS operations. The secondary interpreter, referenced by COMSPEC, is typically spawned for tasks such as running batch files or temporary prompts and terminates upon completion. In Windows operating systems, COMSPEC specifies the path to the system's command interpreter executable for launching command sessions. Default values for COMSPEC vary by operating system but align with the standard command interpreter for each. In , it defaults to C:\COMMAND.COM, the 16-bit command processor. For Windows NT-based systems, including modern versions like and 11, the default is %SystemRoot%\system32[cmd.exe](/page/Cmd.exe), pointing to the 32-bit or 64-bit command interpreter executable. In , COMSPEC is set to cmd.exe, facilitating command execution in its environment. Windows treats environment variable names as case-insensitive, allowing references like ComSpec or comspec to resolve to the same value as COMSPEC, though the uppercase form is the established convention carried over from DOS conventions where variables were traditionally uppercase. This case-insensitivity extends to OS/2, maintaining compatibility across these Microsoft and IBM systems.

Purpose

The COMSPEC environment variable plays a central role in specifying the path to the default command interpreter executable, which processes command lines, batch files, and user inputs within interactive shells in and Windows operating systems. In , it points to , enabling the system to locate and load the interpreter for executing user commands and running .BAT files during system initialization and runtime operations. In Windows, COMSPEC typically directs to , the native command shell, ensuring that command processing occurs through a reliable, system-defined interpreter that handles both interactive sessions and scripted inputs. This variable facilitates the invocation of secondary command processors, allowing tasks such as running executables or nested batch files without disrupting the primary shell environment. For instance, in , mechanisms like the COMMAND /C switch leverage COMSPEC to spawn a temporary instance of the interpreter for isolated execution, preserving the state of the originating batch process. Similarly, in Windows, it supports subprocess creation where the primary environment remains intact, enabling modular command handling in complex workflows. COMSPEC integrates seamlessly with system-level calls, such as the system() function in C programs, by providing a dynamic reference to the interpreter's location, often in conjunction with the PATH variable, to execute commands reliably across processes. This inheritance of environment variables ensures that child processes can access the same interpreter without hardcoded paths. Behaviorally, COMSPEC in MS-DOS supports flexibility by allowing alternative shells, such as JP Software's 4NT, to be designated as the command processor for enhanced features, provided they are specified via the SHELL directive in CONFIG.SYS. In contrast, Windows uses COMSPEC to maintain consistent access to CMD.EXE, preserving backward compatibility for legacy DOS-style applications and scripts that rely on standardized command interpretation.

History

Origins in MS-DOS

The COMSPEC was introduced with 2.0 in March 1983, as part of the operating system's new support for an environment block that enabled configurable system parameters, including the specification of command processors beyond the built-in . This feature allowed to load a primary command interpreter at time while providing flexibility for users to designate interpreters for subprocesses. By default, COMSPEC pointed to the executable located in the or DOS subdirectory. The variable's implementation was closely tied to the SHELL= directive in the file, which 2.0 also introduced for system configuration. The SHELL= command specified the path to the primary command processor (typically ) and any associated parameters, such as the search path for reloading the shell or the environment size; upon loading, this primary instance automatically set the COMSPEC variable to its own path. This setup facilitated runtime overrides, where applications or batch files could spawn secondary command interpreters by invoking the executable named in COMSPEC, independent of the primary shell. For instance, if a program needed to execute a command line without disrupting the main session, it would load a new copy of the interpreter specified by COMSPEC. Early use cases for COMSPEC centered on enabling third-party command shells to enhance functionality. Users could replace the default by modifying the SHELL= directive in to point to an alternative executable, such as 4DOS from JP Software (first released in 1988 for 3.x but compatible with earlier versions via similar mechanisms). This change would update COMSPEC accordingly, allowing the third-party shell to handle both primary and secondary sessions with extended features like improved and command history. Such substitutions were common among advanced users seeking better usability without altering core DOS files. However, COMSPEC's utility in early versions was constrained by the limited size of the environment block. The default allocation was 160 bytes, sufficient for basic variables like COMSPEC, , and but often leading to "out of environment space" errors when additional variables were set or when longer paths were used in COMSPEC. Users could mitigate this by including the /E:nnnn switch in the = directive to expand the block up to , though this required careful in resource-constrained systems.

Evolution in OS/2 and Windows

In 1.0, released in 1987, the was adopted to specify the path to the command interpreter, with established as the default to provide a more advanced interface than MS-DOS's while ensuring for applications through a . With the release of in 1993, COMSPEC was standardized to point to , the 32-bit command processor designed for the kernel, which inherited its value from parent processes to maintain session consistency across the system's multi-subsystem architecture supporting , Win32, , and environments. Windows 95 and 98, introduced in 1995, employed a hybrid model for COMSPEC to bridge the 16-bit foundation with emerging 32-bit capabilities; in MS-DOS mode, it defaulted to for legacy compatibility, while Win32 console sessions utilized , allowing seamless transitions between real-mode DOS sessions and protected-mode Windows operations. A key milestone occurred in , released in 2000, where COMSPEC was formalized as invariantly defaulting to %SystemRoot%\system32[cmd.exe](/page/Cmd.exe) for native console applications, distinguishing it from the used in virtual machines and reinforcing cmd.exe's role as the primary interpreter for batch scripting and system commands in the NT lineage. From onward, including up to in 2025, COMSPEC continued to tie primarily to for legacy support, with enhanced inheritance mechanisms under (UAC) ensuring that child processes receive the parent's access token to enforce privilege boundaries during elevation prompts; this integration coexists with as the preferred modern shell, but persists for compatibility with decades-old scripts and applications.

Usage

Configuration Methods

The COMSPEC environment variable can be viewed in Windows command prompt by executing the set COMSPEC command, which displays its current value, or by using echo %COMSPEC% to output it directly. In batch files, the latter echo command is similarly used to retrieve the value during script execution. For a graphical interface, users access it through System Properties by navigating to Advanced system settings > Environment Variables, where COMSPEC appears under system variables. To set COMSPEC temporarily within a command prompt session, the set command is employed, such as set COMSPEC=C:\Windows\System32\[cmd.exe](/page/Cmd.exe), which applies the change only to the current and its child processes until the session ends. This method overrides the default path, like %SystemRoot%\system32\[cmd.exe](/page/Cmd.exe), for testing alternative command interpreters without permanent effects. For permanent configuration in Windows, the variable is modified via the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment, where the ComSpec entry is set as a REG_EXPAND_SZ value pointing to the desired executable path, such as %SystemRoot%\system32\[cmd.exe](/page/Cmd.exe); changes require a system restart to take effect. In , the COMSPEC variable is set by the SHELL directive in (e.g., SHELL=C:\DOS[COMMAND.COM](/page/COMMAND.COM) /P), which loads the command interpreter. It can be overridden in using SET COMSPEC=C:\DOS[COMMAND.COM](/page/COMMAND.COM) if necessary. In , permanent configuration involves editing . For the OS/2 shell, use SET COMSPEC=C:\OS2[CMD.EXE](/page/Cmd.exe). For DOS compatibility, use SHELL=C:\OS2[COMMAND.COM](/page/COMMAND.COM) /P /E:1024. Validation of the COMSPEC is essential to prevent errors; the specified must point to a valid, accessible , as an invalid triggers issues like "Cannot locate COMSPEC ," which disrupts command execution and . In , the SET command functions analogously to for both temporary and configuration purposes, maintaining compatibility across these legacy s.

Application in Scripts and Programs

In batch files, the COMSPEC environment variable is commonly invoked using the syntax %COMSPEC% /c <command> to execute a specific command in a new command interpreter instance without interrupting the parent script's execution. This approach ensures that the command runs synchronously and returns control to the batch file upon completion, allowing for seamless integration in automated workflows. For instance, to list directory contents and redirect output to a file, a batch script might include %COMSPEC% /c dir > output.txt, which leverages the default command interpreter while avoiding pauses or nested shells. In programming contexts, COMSPEC facilitates the execution of shell commands from within applications. In C and C++, the system() function from the C runtime library expands the COMSPEC variable to locate and invoke the command interpreter (typically cmd.exe), enabling programs to run external commands as if from the shell. For example, calling system("dir") internally resolves to the COMSPEC path, ensuring compatibility across Windows environments without hardcoding the interpreter location. Similarly, in PowerShell scripts, the Start-Process cmdlet can target $env:COMSPEC to launch command interpreter sessions, such as Start-Process -FilePath $env:COMSPEC -ArgumentList "/c dir", which provides controlled process spawning with options for waiting or redirection. COMSPEC plays a key role in system automation tools, particularly for maintaining legacy compatibility. In , jobs configured to run batch files often rely on COMSPEC to execute DOS-era commands in modern environments, ensuring that older scripts process correctly without modification. Third-party automation software, such as , references %ComSpec% in its to perform executions, for example, Run %ComSpec% /c echo Hello > file.txt, allowing hotkeys or scripts to interact with the command line reliably across system configurations. To enhance portability, scripts should verify that COMSPEC is defined before usage, preventing runtime failures in environments where the variable might be unset or altered. In batch files, this can be checked with if not defined [COMSPEC](/page/COMSPEC) (echo COMSPEC not set & exit /b 1), a technique that tests for the variable's presence and provides a graceful fallback. In programming languages like C++, querying the environment via getenv("[COMSPEC](/page/COMSPEC)") and handling null returns similarly ensures robust error management. The /c and /k switches provide variants for controlling post-execution behavior when invoking COMSPEC. The /c switch carries out the specified command and terminates the interpreter immediately, ideal for non-interactive scripts that require clean exits. In contrast, the /k switch executes the command but keeps the interpreter session open, useful for or interactive follow-up in scenarios.

Security Considerations

Exploitation Techniques

Attackers frequently exploit the to obfuscate malicious command execution, leveraging it to disguise harmful activities as routine operations. By invoking commands through '%COMSPEC% /c <malicious_command>', executes payloads while the /c flag ensures the shell terminates after running the command, minimizing footprint and appearing as benign activity in logs and tools. This evades static detection since it relies on a legitimate system variable pointing to , blending seamlessly with normal administrative or scripting behaviors. For persistence, adversaries with elevated privileges modify the COMSPEC variable in the system registry (typically under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) to redirect it to a trojaned , such as a renamed wrapper containing malicious code. This alteration causes every new instance—launched by applications, services, or user interactions—to execute the attacker's automatically, ensuring long-term access without relying on traditional startup folders or scheduled tasks. Such modifications persist across reboots and are particularly effective in environments where invocations are frequent. In lateral movement scenarios, tools like Impacket's smbexec abuse COMSPEC to facilitate remote command execution over without leaving obvious artifacts. The tool establishes a temporary on the target host that chains '%COMSPEC% /c' to run commands and redirect output via named pipes, enabling semi-interactive sessions while avoiding direct file drops or interactive logons that could trigger alerts. This method exploits legitimate Windows features, allowing attackers to across networks stealthily. Real-world examples illustrate COMSPEC's role in advanced campaigns. In 2021, weaponized analyzed by used nested layers culminating in %COMSPEC% invocations to load into memory, maintaining access during post-exploitation phases. Similarly, operations have employed —invoked via COMSPEC—for registry modifications to embed persistence mechanisms, as documented in mappings of their tactics. In incidents involving certutil for payload decoding, attackers wrapped commands in %COMSPEC% /c to silently extract and execute base64-encoded , a pattern observed in 2019 campaigns targeting enterprises. Detecting COMSPEC abuse presents significant challenges due to its of privileges and integration with standard workflows. Malicious invocations often run under legitimate user or service contexts, such as , making them indistinguishable from authorized scripting without deep inspection of command-line arguments or behavioral anomalies like unusual child processes from .

Mitigation Measures

To mitigate vulnerabilities associated with the environment variable, organizations should implement robust monitoring mechanisms to detect unauthorized modifications or invocations. Tools such as Sysmon from can be configured to log process creations (Event ID 1) with command-line arguments, enabling detection of processes spawning command interpreters via non-standard COMSPEC paths, such as those altered to point to malicious binaries. Similarly, Windows Event Logs can track registry modifications to the COMSPEC value located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager[Environment](/page/The_Persistence) by enabling auditing for the "Registry" subcategory, which generates Event ID 4657 upon value changes; alerts should be set for deviations from the default path %SystemRoot%\system32[cmd.exe](/page/Cmd.exe). These logs facilitate real-time alerting on suspicious activity, such as path alterations that could enable command injection or . Integrity checks play a critical role in preventing trojanized substitutions of . policies, configurable via , allow administrators to create executable rules that restrict execution to only the verified system path (%SystemRoot%\system32[cmd.exe](/page/Cmd.exe)), denying launches from alternative locations unless explicitly allowed for authorized users or groups. Complementing this, Windows Defender Application Control (WDAC) provides code integrity enforcement by whitelisting signed and trusted binaries, ensuring that only the legitimate from can run while blocking unsigned or relocated variants that exploit COMSPEC tampering. These controls directly counter exploitation patterns like environment variable hijacking by limiting the to authenticated components. Adopting the principle of least privilege further reduces risks by minimizing the of potentially compromised variables during process creation. When spawning child processes, applications should use APIs like CreateProcess with the lpEnvironment parameter set to a custom block to prevent of modified COMSPEC values from environments, thereby isolating sensitive operations. As an alternative to for scripting, in constrained language mode—enforced via the __PSLockdownPolicy registry value or —limits script execution to approved, signed , blocking dynamic generation or unsafe calls that could be triggered through COMSPEC abuse. Regular audits ensure ongoing verification of COMSPEC integrity against baselines. Administrators can use scripts to periodically scan the registry and process environments for alterations, comparing the COMSPEC value to the standard %SystemRoot%\system32[cmd.exe](/page/Cmd.exe) and logging discrepancies via Event ID 4657 audits. These scans, combined with comparisons, help identify attempts early. Finally, maintaining up-to-date Windows systems is essential to address related access vulnerabilities. Applying patches for known issues, such as those outlined in CISA advisories (e.g., CVE-2022-47966, which enables unauthorized execution), closes pathways that could intersect with COMSPEC manipulations. recommends enabling automatic updates via to ensure timely remediation of such flaws.

References

  1. [1]
    start | Microsoft Learn
    Oct 2, 2023 · ... COMSPEC variable. This prevents users from picking up cmd from the current directory. If you run a 32-bit graphical user interface (GUI) ...
  2. [2]
    COMSPEC environment variable - DOS/Command Prompt Reference
    Jun 13, 2023 · COMSPEC environment variable contains the path to the command interpreter (Command.com or Cmd.exe), and is used mainly by the system.Missing: history | Show results with:history<|control11|><|separator|>
  3. [3]
    set (environment variable) - Windows commands - Microsoft Learn
    Sep 6, 2023 · These settings usually include the COMSPEC and PATH environment variables, which are used to help find programs on disk. Two other ...
  4. [4]
    Studio - Check if ComSpec variable is defined correctly
    Manually add the correct value for the ComSpec environment variable. This variable is set at Windows installation and must be set to: %SystemRoot%\system32\cmd.
  5. [5]
    PostgreSQL Installation Error: The environment variable COMSPEC ...
    Feb 14, 2023 · When installing PostGreSQL, the installer displays the splash screen and then fails with an error msg stating that the ComSpec doesn't point ...
  6. [6]
    COMMAND.COM, SHELL and COMSPEC
    Sep 19, 2016 · COMMAND.COM is DOS's 16-bit command interpreter. SHELL specifies the primary command processor, and COMSPEC specifies the secondary command ...
  7. [7]
    MS-DOS v6.22 Help: COMMAND
    ... DOS directory on drive C: shell=c:\dos\command.com c:\dos\ /e:1024 This command directs MS-DOS to set the COMSPEC environment variable to C:\DOS\COMMAND.COM.
  8. [8]
  9. [9]
    Solved - Environmental Variable ComSpec | Windows 8 Help Forums
    Jul 7, 2016 · The COMSPEC environment variable can be used to specify where command.com (DOS) or cmd.exe (OS/2, Windows) can be found. It could also be used ...
  10. [10]
  11. [11]
    Environment Variables in Windows/macOS/Linux
    Environment Variables in Windows are NOT case-sensitive (because the legacy DOS is NOT case-sensitive). They are typically named in uppercase, with words joined ...Missing: insensitive | Show results with:insensitive
  12. [12]
    The MS-DOS Encyclopedia: Section III: User Commands
    With MS-DOS versions 2.x and 3.x, two particular variables are always found in an environment: PATH and COMSPEC. These variables are initialized during the ...
  13. [13]
    cmd
    ### Summary of COMSPEC Environment Variable and Its Role
  14. [14]
    system, _wsystem | Microsoft Learn
    Jun 4, 2017 · system uses the COMSPEC and PATH environment variables to locate the command-interpreter file CMD.exe. If command is NULL , the function just ...
  15. [15]
    Windows Environment Variables: A Beginner's Guide - Studylib
    [6][7] %COMSPEC% (supported since DOS 2.0) This variable contains the full 8.3 path to the command processor, typically C:\COMMAND.COM or C:\DOS\COMMAND.COM.
  16. [16]
    How does the command.com shell work with MS-DOS?
    Apr 26, 2016 · COMMAND.COM allows other programs to run its internal commands (in DOS, even commands such as DIR and COPY are implemented in the command ...Missing: 4NT | Show results with:4NT
  17. [17]
    Klaus Meinhard's Homepage: Title - 4DOS.INFO
    Under MS-DOS and PC-DOS you probably won't need to set the COMSPEC directory on the SHELL= line or in AUTOEXEC. 4DOS sets it automatically in most cases, ...Missing: early | Show results with:early
  18. [18]
    Section II: Programming in the MS-DOS Environment - PCjs Machines
    The default MS-DOS user interface is a replaceable shell program called COMMAND.COM. One of the fundamental tasks of a shell is to load a program into memory on ...
  19. [19]
    OS/2 1.0
    The DOS box provided a relatively high degree of compatibility with DOS, including the ability to run Windows 2.03. The OS/2 command interpreter (CMD.EXE) was ...
  20. [20]
    The Evolution of the Windows Command-Line
    Jun 27, 2018 · In this post we'll discuss some of the background & history behind the Windows Command-Line. Specifically, we'll explore its humble origins in ...
  21. [21]
    FAQs Regarding the Windows 2000 Command Processor
    Jul 15, 2002 · Answer: Windows 2000 supports two (2) command processors: - COMMAND.COM is the command processor for the virtual DOS Machine (VDM), ...
  22. [22]
    How User Account Control works | Microsoft Learn
    Apr 15, 2025 · Child processes inherit the user's access token from the parent process. Both the parent and child processes, however, must have the same ...Uac Process And Interactions · Sign In Process · The Uac User ExperienceMissing: COMSPEC Vista
  23. [23]
    Windows environment variables cannot be parsed correctly
    Nov 13, 2023 · Some of these environment variables can be parsed, while in some situations they cannot be parsed, which bothers me, hoping to receive a suitable solution.
  24. [24]
    Setting COMSPEC & SHELL in OS/2; SHELL "Illegal Function Call"
    In the OS/2 DOS 3.x compatibility box, a program can generate an "Illegal function call" if the COMSPEC environment variable is placed in the AUTOEXEC.BAT.
  25. [25]
    [PDF] User's Manual for the Cultural Resources Information System (CRIS ...
    Cannot locate COMSPEC environment variable. (1412) or (412). An environment variable needed by the program which runs CRIS cannot be found. This error ...<|separator|>
  26. [26]
    Hey, Scripting Guy! How Can I Use Data Read From a Text File as ...
    Oh, and at the very beginning of the string we insert this construction: %comspec% /c. What's that for? Well, that simply tells the script that we want to run ...
  27. [27]
    CMD.exe (Command Shell) - Windows CMD - SS64.com
    If /C or /K is specified, then the remainder of the command line is processed as an immediate command in the new shell. Multiple commands separated by the ...
  28. [28]
    system, _wsystem - Microsoft Learn
    Feb 17, 2023 · system uses the COMSPEC and PATH environment variables to locate the command-interpreter file CMD.exe. If command is NULL , the function just ...
  29. [29]
    Start-Process (Microsoft.PowerShell.Management)
    The Start-Process cmdlet starts one or more processes on the local computer. By default, Start-Process creates a new process that inherits all the environment ...
  30. [30]
    Task Scheduler for developers - Win32 apps | Microsoft Learn
    Jul 15, 2024 · The Task Scheduler enables you to automatically perform routine tasks on a chosen computer. The Task Scheduler does so by monitoring whatever criteria you ...Missing: legacy | Show results with:legacy
  31. [31]
    Batch files - How To ... Verify if Variables are Defined
    Apr 15, 2024 · The following batch file demonstrates the differences between the 4 "defined check methods" for static variable COMSPEC vs all dynamic variables.
  32. [32]
  33. [33]
    From PowerShell to Payload: An Analysis of Weaponized Malware
    May 4, 2021 · In this blog, we look at some malicious PowerShell code breadcrumbs that one hacker left behind to unravel how they maintained access during ...
  34. [34]
    How Fileless Malware Abuses a Windows Command
    Aug 7, 2025 · How Fileless Malware Abuses a Windows Command. An inside look at how attackers exploit %COMSPEC% to silently execute malicious code using built- ...
  35. [35]
    Impacket remote execution tools smbexec.py - u0041
    smbexec.py is a script that comes with Impacket. It allows remote code execution through a semi-interactive shell by creating services that execute commands ...Missing: %COMSPEC% | Show results with:%COMSPEC%
  36. [36]
    DFIR Breakdown: Impacket Remote Execution Activity - smbexec
    Sep 20, 2024 · Smbexec is part of the Impacket tools and allows an attacker to launch programs remotely. It's similar to PsExec, but it uses the SMB protocol to get command ...
  37. [37]
    Command and Scripting Interpreter: Windows Command Shell
    The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a ...
  38. [38]
    Windows Privilege Abuse: Auditing, Detection, and Defense
    Jan 29, 2019 · Defenders who understand privileges and how attackers may abuse them can enhance their detection and attack surface reduction capabilities.
  39. [39]
    Real-World Examples of Detecting Attacks with Sysmon - Blumira
    Mar 1, 2024 · The attacker used an encoded PowerShell command that executed from a base64-encoded payload hidden inside the %ComSpec% environment variable.<|separator|>
  40. [40]
    Sysmon - Sysinternals - Microsoft Learn
    Jul 23, 2024 · Sysmon is a Windows service and driver that monitors and logs system activity, including process creations, network connections, and file ...Missing: COMSPEC | Show results with:COMSPEC
  41. [41]
    Working with AppLocker rules - Microsoft Learn
    Oct 1, 2024 · This article for IT professionals describes AppLocker rule types and how to work with them for your application control policies.
  42. [42]
    PowerShell Constrained Language Mode - Microsoft Developer Blogs
    Nov 2, 2017 · Use the Windows Task Scheduler or PowerShell ScheduledTasks module as an alternative. For more information see CVE-2018-0958. What is ...
  43. [43]
    Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and ...
    Sep 7, 2023 · Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing ...