The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 17 Jul 2024.
Severity
Medium 6.5
Published
29 Mar 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
VMware vCenter ServerServers and applications · cpe:a:vmware:vcenter_server
Version 7.0-update3
Version 7.0-update2d
Version 7.0-update2
Version 7.0-update1d
All 61 release lines
Version 6.5-a
Version 6.5-b
Version 6.5-c
Version 6.5-update1b
Version 6.5-update1c
Version 6.5-update2b
Version 6.5-update2c
Version 6.5
Version 6.5-d
Version 6.5-e
Version 6.5-f
Version 6.5-update1
Version 6.5-update1d
Version 6.5-update1e
Version 6.5-update1g
Version 6.5-update2
Version 6.5-update2d
Version 6.5-update2g
Version 6.5-update3
Version 6.5-update3d
Version 6.5-update3f
Version 6.5-update3k
Version 6.5-update3n
Version 6.5-update3p
Version 6.5-update3q
Version 6.7-a
Version 6.7-b
Version 6.7-update1b
Version 6.7-update2a
Version 6.7-update2c
Version 6.7-update3a
Version 6.7-update3b
Version 6.7
Version 6.7-d
Version 6.7-update1
Version 6.7-update2
Version 6.7-update3
Version 6.7-update3f
Version 6.7-update3g
Version 6.7-update3j
Version 6.7-update3l
Version 6.7-update3m
Version 6.7-update3n
Version 6.7-update3o
Version 7.0-a
Version 7.0-b
Version 7.0-c
Version 7.0-update1a
Version 7.0-update1c
Version 7.0-update2a
Version 7.0-update2b
Version 7.0-update2c
Version 7.0-update3a
Version 7.0-update3c
Version 7.0
Version 7.0-d
Version 7.0-update1
Version 7.0-update1d
Version 7.0-update2
Version 7.0-update2d
Version 7.0-update3
Known exploited
CISA name
VMware vCenter Server Incorrect Default File Permissions Vulnerability
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.