Vulnerability Spotlight: Data deserialization in VMware vCenter could lead to remote code execution
Summary: Marcin "Icewall" Noga of Cisco Talos discovered a post-authentication Java deserialization vulnerability in VMware vCenter, tracked as TALOS-2022-1587 (CVE-2022-31680), that is triggered by a specially crafted HTTP request and could allow an attacker to execute arbitrary code on the target machine. The attacker must first log in with legitimate vCenter credentials, and Talos confirmed that VMware vCenter Server version 6.5 update 3t could be exploited; VMware has released an update, and Snort rule 60433 detects exploitation attempts.
What's compelling: The flaw requires valid credentials, so the exposure sits with anyone who already holds a vCenter login - including compromised or over-privileged accounts - and exploitation of the confirmed 6.5 update 3t version can yield arbitrary code execution on the system that manages the entire VM environment.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-31680
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026