CVE Watch—

CVE-2022-22948

VMware vCenter Server Incorrect Default File Permissions Vulnerability

CVSS

—

No CVSS

EPSS

13.9%

p96

KEV

YES

Jul 17, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

13.9%EPSS · 30 days13.9%

2026-06-302026-07-16

KEV catalog record

Product

VMware / vCenter Server

Vulnerability

VMware vCenter Server Incorrect Default File Permissions Vulnerability

Added to KEV

Jul 17, 2024

Remediate by

Aug 7, 2024

Known ransomware use

Summary description

VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.vmware.com/security/advisories/VMSA-2022-0009.html; https://nvd.nist.gov/vuln/detail/CVE-2022-22948

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-21985—

100.0%

KEV—80VMware vCenter Server Improper Input Validation Vulnerability—CVE-2021-22005—

100.0%

KEV—80VMware vCenter Server File Upload Vulnerability—CVE-2023-34048—

99.9%

KEV—80VMware vCenter Server Out-of-Bounds Write Vulnerability—CVE-2021-21972—

99.9%

KEV—80VMware vCenter Server Remote Code Execution Vulnerability—CVE-2020-3952—

99.8%

KEV—80VMware vCenter Server Information Disclosure Vulnerability—CVE-2024-38812—

98.9%

KEV—80VMware vCenter Server Heap-Based Buffer Overflow Vulnerability—