CVE-2022-31680

PoC —

CVSS 3.1

9.1 critical

EPSS

33%p98

Published

Oct 7, 2022 (Oct 7, 2022)

Modified

Jun 17, 2026

Description

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.

Vendors: vmware
Products: vcenter server
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (33.1%)

In the news2 stories

Vulnerability Spotlight: Data deserialization in VMware vCenter could lead to remote code execution

Cisco TalosOct 11, 14:21 UTC · Oct 11, 2022Vulnerability in the wildCVE-2022-31680

VMware fixed a high

Security AffairsOct 7, 22:03 UTC · Oct 7, 2022Vulnerability CVE-2022-31680 CVE-2022-31681