CVE-2024-22250

CVSS 3.1: 7.8 high
EPSS: <1%p28
Published: Feb 20, 2024 · Feb 20, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-22250 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.

Weakness: CWE-384

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news

4 stories

Week in review: 10 cybersecurity startups to watch, admins urged to remove VMware vSphere plugin

Help Net SecurityFeb 25, 00:00 UTC · Feb 25, 2024RansomwareCVE-2024-22245 CVE-2024-22250 CVE-2024-1709+11 · 1 read

VMware Alert: Uninstall EAP Now - Critical Flaw Puts Active Directory at Risk

The Hacker NewsFeb 22, 02:28 UTC · Feb 22, 2024VulnerabilityCVE-2024-22245 CVE-2024-22250 CVE-2024-217262

Critical flaw found in deprecated VMware EAP. Uninstall it now

Security AffairsFeb 21, 11:37 UTC · Feb 21, 2024RansomwareCVE-2024-22245 CVE-2024-222502 · 1 read

VMware pushes admins to uninstall vulnerable, deprecated vSphere plugin (CVE-2024-22245, CVE-2024-22250)

Help Net SecurityFeb 25, 16:34 UTC · Feb 25, 2024VulnerabilityCVE-2024-22245 CVE-2024-222503 · 1 read