CVE-2022-31680

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.

Affected

VMware vCenter Server

CVSS v3.1 NVD

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

33.06% chance of exploitation in the next 30 days, 98th percentile

Published

2022-10-07

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1587

Security advisories

• https://www.vmware.com/security/advisories/VMSA-2022-0025.html

References

• CVE Record
• NVD entry