CVE-2022-22939: VMware Cloud Foundation

Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days.

VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.

Affected products

• VMware Cloud Foundation: from 3.0, up to and including 3.10.2.2; from 4.0, up to and including 4.1.0.1

Published 2022-02-04. Last modified 2026-06-17.