CASCACascade Atlas

Evidence dossier

CVE-2022-22948

The vCenter Server contains an information disclosure vulnerability due to improper permission of files.

Exploited in the wild (CISA KEV since Jul 17, 2024). NVD reports CVSS 3.1 6.5. EPSS estimates 13.3% exploit likelihood as of Aug 27, 2026.

67.1–71.7Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

State
PUBLISHED
Published
Mar 29, 2022
Updated
Oct 21, 2025
Evidence coverage
98%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    vmware

    Record text: The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

    Inspect raw assertion
    Field
    container
    Value
    The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: VMware vCenter Server Incorrect Default File Permissions Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    VMware vCenter Server Incorrect Default File Permissions Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 13.28% probability · 96.1th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.132820000000; percentile 0.960990000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Jul 17, 2024 · first observed Jul 19, 2026

Exploit likelihood13.28%

FIRST EPSS · score date Aug 27, 2026 · 96.1th percentile · first observed Aug 27, 2026

SeverityCVSS 6.5

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

Outside this view’s verified evidence

Reason detail begins outside this selected snapshot; the state remains source-bound.

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
vmwareOriginal assertion
Record text

The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.

Inspect raw assertion
Field
container
Value
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

VMware vCenter Server Incorrect Default File Permissions Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
VMware vCenter Server Incorrect Default File Permissions Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

13.28% probability · 96.1th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.132820000000; percentile 0.960990000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
63Underlying assertions
2Canonical products
63Target assertions
0Constraint assertions

Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

8 scope groups

vmware · source assertedn/aVMware vCenter Server and VMware Cloud FoundationDirect source scope
Affected: VMware vCenter Server (7.0 prior to 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMware Cloud Foundation (4.x and 3.x prior to 3.11)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "VMware vCenter Server (7.0 prior to 7.0 U3d, 6.7 prior to 6.7 U3p and 6.5 prior to 6.5 U3r) and VMware Cloud Foundation (4.x and 3.x prior to 3.11)"}]
CISA-ADP · source assertedvmwarecloud_foundationDirect source scope
Affected: 4.0 to before 5.0 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.0", "lessThan": "5.0", "versionType": "custom"}]
CISA-ADP · source assertedvmwarecloud_foundationDirect source scope
Affected: 3.0 to before 3.11 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "3.0", "lessThan": "3.11", "versionType": "custom"}]
CISA-ADP · source assertedvmwarevcenter_serverDirect source scope
Affected: 7.0 to before 7.0_u3d (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "7.0", "lessThan": "7.0_u3d", "versionType": "custom"}]
CISA-ADP · source assertedvmwarevcenter_serverDirect source scope
Affected: 6.7 to before 6.7_u3p (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.7", "lessThan": "6.7_u3p", "versionType": "custom"}]
CISA-ADP · source assertedvmwarevcenter_serverDirect source scope
Affected: 6.5 to before 6.5_u3r (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "6.5", "lessThan": "6.5_u3r", "versionType": "custom"}]
NVD CPE · APPLICATIONvmwarecloud_foundationVulnerable target · 2 assertions
Any version (unconstrained) (>= 3.0, < 3.11); Any version (unconstrained) (>= 4.0, < 4.4.1)Canonical identity product-29d7e06677052d6292d0854ba656869395ea8e26a3dfe12b466a234813f9d5c3Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    from including 4.0; through excluding 4.4.1
    Match ID
    73f75d28-e505-4da6-9e0f-7b38a19cc64c
  2. cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    from including 3.0; through excluding 3.11
    Match ID
    28769d3c-0c46-4e6b-a8e2-75a7b64b1d47
NVD CPE · APPLICATIONvmwarevcenter_serverVulnerable target · 61 assertions
Version 6.5; Version 6.7; Version 7.0Canonical identity product-7b67c9fc3345279c14c2ffdcfdb4cfa4924c4b40fd0abb29ff5aeb5ac44092a7Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 61
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3bad2012-5c82-4ea9-a780-9bf1da5a18ab
  2. cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 47
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0ee83406-a3d9-4f75-a1a6-63831cebeec1
  3. cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 48
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    fb563627-c9cf-4d8a-b882-9ab65eae9e15
  4. cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 36
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    04487105-980a-4943-9360-4442bf0411e6
  5. cpe:2.3:a:vmware:vcenter_server:6.7:update3o:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 45
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    efddf4ca-1c20-430e-a17c-cc2998f8bddf
  6. cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    46fc9f34-c8fa-4afe-9f4a-7cf9516bd4d9
  7. cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    786cdd50-7e18-4437-8db9-2d0adecd436e
  8. cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 38
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8af12716-88e2-44b5-acd7-bcbeca130fb8
  9. cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 54
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    85dd238c-ef73-44f0-928e-a94ff5c4b378
  10. cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 31
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23253631-2655-48a8-9b00-cb984232329c
  11. cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 28
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5241c282-a02b-44b2-b6ca-ba3a99f9737c
  12. cpe:2.3:a:vmware:vcenter_server:6.5:update1c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9b4d3f61-6cd9-411f-a205-eb06a57ebb4e
  13. cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d26534eb-327b-4ed6-a3e1-005552cb1f9d
  14. cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 53
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0fc6765a-6584-45a8-9b21-4951d2ea8939
  15. cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23cfe5a5-a166-4fd5-be97-5f16dab1eae0
  16. cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 34
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    31ca7802-d78d-4bad-a45a-68b601c010c6
  17. cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1dd16169-a7df-4604-888c-156a60018e32
  18. cpe:2.3:a:vmware:vcenter_server:6.5:update1b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0064d104-e0d8-481a-9029-d3726a1a9cf4
  19. cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dbd9a341-1fbf-4e04-848b-550deb27261a
  20. cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f72a1e9c-f960-4e8c-a46c-b38209e6349e
  21. cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 39
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3352212c-e820-47b3-bdf5-57018f5b9e81
  22. cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 33
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ee4d3e2a-c32d-408f-b811-ef8bc86f0d34
  23. cpe:2.3:a:vmware:vcenter_server:6.5:update3q:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 26
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    af7e87bb-1b5b-4f13-a70c-b3c6716e7919
  24. cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 27
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e456f84c-a86e-4ea9-9a3e-beea662136e6
  25. cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 62
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    58597f18-0b23-4d21-9aba-d9773958f10e
  26. cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 60
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6508a908-ef14-4a72-ac75-5da6f8b98a0e
  27. cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4955663c-1bb6-4f3e-9d4b-362df144b7f1
  28. cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 56
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0da882b6-d811-4e4b-b614-2d48f0b9036e
  29. cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 46
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5fa81ccd-a05e-498c-820e-21980e92132f
  30. cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 50
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a2392d0f-d7a2-4e01-9212-1ba6c895aebf
  31. cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 40
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6436adfd-6b94-4d2a-b09b-ced4ec6ca276
  32. cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b2ce8dae-0e78-4004-983d-1ecd8855ec33
  33. cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 51
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6d731c1a-9fe5-461c-97e2-6f45e4cbabe1
  34. cpe:2.3:a:vmware:vcenter_server:6.7:update3l:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 42
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    726ac46d-9ea8-4fe8-94b8-0562935458f2
  35. cpe:2.3:a:vmware:vcenter_server:6.5:update1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7e51f433-1152-4e94-af77-970230b1a574
  36. cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 59
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b266439f-e911-4c95-9d27-88df96ddccd5
  37. cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cf7ddb0c-3c07-4b5e-8b8a-0542fee72877
  38. cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 29
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    04a60ac7-c2ea-4dbf-9743-54d708584afa
  39. cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2f0a79c2-33ae-40c5-a853-770a4c691f29
  40. cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 32
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    50c2a9a8-0e66-4702-bcd4-74622108e7a6
  41. cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bddc6510-3116-4578-80c8-8ef044a8370a
  42. cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ce0f8453-3d6c-4f1c-9167-3f02e3d905dc
  43. cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 41
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d06832ce-f946-469d-b495-6735f18d02a0
  44. cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 58
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    188e103e-9568-4ce0-a984-141b2a9e82d2
  45. cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 57
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8d30a78e-16d0-4a2e-a2f8-f6073698243e
  46. cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2c33ce46-f529-4ea9-9344-6ed3bfa7019d
  47. cpe:2.3:a:vmware:vcenter_server:6.5:update3n:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 24
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d8bb6cbc-11d6-40a4-abaf-53ab9bed5a73
  48. cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 55
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f4ca36c1-732e-41ae-b847-f7411b753f3d
  49. cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 49
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    dca03b2a-48b2-48ad-b8eb-9d7bb2016819
  50. cpe:2.3:a:vmware:vcenter_server:6.5:update3p:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 25
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    26a3ec15-8c04-49ad-9045-4d9fadbd50cd
  51. cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 52
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8725e544-2a94-4829-a683-1ecce57a74a6
  52. cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 35
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3b98981b-4721-4752-bab4-361db5aeb86f
  53. cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 37
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    24d24e06-eb3f-4f11-849b-e66757b01466
  54. cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8678db48-cb98-4e4c-ade6-caba73265fec
  55. cpe:2.3:a:vmware:vcenter_server:6.7:update3m:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 43
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0243d22f-1591-4a95-a7fe-2658cee0c08f
  56. cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0ead4045-a7f9-464f-abb9-3782941162cc
  57. cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 30
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8a91b0c4-f184-459e-afd3-de0e351cc964
  58. cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9f1d8161-0e02-45c9-bf61-14799ab65e03
  59. cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1aeda28a-5c8e-4e95-a377-3be530dbeab5
  60. cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1f2cb1ff-6118-4875-945d-07baa3a21ffa
  61. cpe:2.3:a:vmware:vcenter_server:6.7:update3n:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 44
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    02ae5983-cd14-4eaf-9f5c-1281e3de7f46

Affected-product evidence

Accepted scope and product mapping

0 canonical links · 0 source-reported links

Applicability remains source-scoped; safety and exposure remain unassessed.

Assessments

CVSS by origin

6.5
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:L/Au:S/C:P/I:N/A:N
6.5
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Affected-product evidence remains source-scoped; canonical linkage is required before applicability scoring.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.