CVE-2022-22982: VMware Cloud Foundation

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.

Affected products

• VMware Cloud Foundation: from 3.0, up to and including 3.11; from 4.0, up to and including 4.3.1
• VMware vCenter Server: version 6.5 only; version 6.7 only; version 7.0 only

Published 2022-07-13. Last modified 2026-06-17.