What’s Vulnerable › Vulnerabilities

CVE-2022-31680

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 33.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-07 · updated 2026-06-17
• Weakness: CWE-502

Description

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.

Affected products

• VMware vCenter Server: before 6.5; 6.5, 6.5-a, 6.5-b, 6.5-c, 6.5-d, 6.5-update1 (+21) — fixed in 6.5
• VMware vCenter Server: from VMware vCenter Server 6.5 prior through U3u

How to fix

Upgrade to a fixed version: VMware vCenter Server 6.5. Check the vendor advisory for mitigations.

References

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587
• https://www.vmware.com/security/advisories/VMSA-2022-0025.html
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587
• https://www.vmware.com/security/advisories/VMSA-2022-0025.html

Get alerted when CVE-2022-31680 or the next vulnerability affects your stack