Cobalt Strike released an out of band update and fixed an XSS (CVE-2022-39197) in their teamserver that could lead to RCE. An attacker could use a malformed username in the Beacon configuration to trigger it. A follow-up three weeks later covers 4.7.2, which fixes an RCE the 4.7.1 patch left open.
Never leave your team server exposed.