CVE-2022-22948

Medium6.5 Published on Mar 29, 2022

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Jul 17, 2024
US federal agencies must remediate it by Aug 7, 2024 (BOD 22-01)
First attack observed 811 days after disclosure

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Jul 28, 2025 May 8, 2025 Jul 17, 2024 Jun 18, 2024

CVSS score6.5 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness type (CWE)CWE-276, CWE-276

Vendorsvmware

Affected products

Vendors	Product	Versions
vmware	cloud foundation	< 3.11
vmware	vcenter server	6.5

Vulnerabilities

VMware Workstation and Fusion: Two Flaws Allow Escape from the Virtual Machine

Broadcom fixed two critical VMware Workstation and Fusion flaws allowing VM escape to host. Upgrade to 26H1u1 to patch CVE-2026-59346, CVE-2026-59347.

Sep 4, 202623:09 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

VMware Workstation and Fusion: Two Flaws Allow Escape from the Virtual Machine