CVE-2022-31678: VMware Cloud Foundation

Critical severity, CVSS 9.1. EPSS: 8.3% chance of exploitation in the next 30 days.

VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.

Affected products

• VMware Cloud Foundation: before 3.11 (fixed in 3.11)
• VMware Nsx Data Center: before 6.4.14 (fixed in 6.4.14)

Published 2022-10-28. Last modified 2026-06-17.