---
title: "vCenter CVE-2022-22948: DB Credential Leak Used by UNC3886"
url: https://erroneo.us/security/briefs/vcenter-cve-2022-22948-postgres-credential-exposure/
description: "A 2022 vCenter file-permission bug exposed database credentials and was later used by China-nexus UNC3886. Fixed in 7.0 U3d, 6.7 U3p, 6.5 U3r. Check builds."
type: security-brief
section: "Security Digest"
date_published: 2022-03-29
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2022-22948"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# vCenter CVE-2022-22948: DB Credential Leak Used by UNC3886

**Verdict: Check exposure.** Fixed since March 2022 and only useful to someone already on the appliance, but an espionage group used it to reach ESXi hosts; make sure no vCenter is still on an old 6.x or 7.0 build, and hunt if one was.

- **Who must act:** Teams with any vCenter Server Appliance on 6.5, 6.7 or 7.0, patched or not, since those lines are out of general support and later vCenter bugs are also exploited.
- **Who can relax:** Organizations without on-premises vCenter, and teams already on current 8.0 or 9.x builds whose older appliances were patched in 2022 and never showed signs of intrusion.
- **Affected:** vCenter Server 7.0 before 7.0 U3d; vCenter Server Appliance 6.7 before 6.7 U3p; vCenter Server Appliance 6.5 before 6.5 U3r; VMware Cloud Foundation 4.x before 4.4.1 and 3.x before 3.11; Windows-based vCenter 6.5 and 6.7 are not affected
- **Fixed:** vCenter 7.0 U3d, 6.7 U3p and 6.5 U3r (Mar 29, 2022); Cloud Foundation 4.4.1 and 3.11; Today: vCenter 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later, because of exploited CVE-2026-59310
- **CVEs:** CVE-2022-22948
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every vCenter, including the ones inside Cloud Foundation, and record its build with vpxd -v on the appliance.
2. Move any 6.5, 6.7 or 7.0 appliance to a supported 8.0 or 9.x release; those lines are past end of general support.
3. Bring 8.0 and 9.x appliances to 8.0 U3k, 9.0.2.0100, 9.1.0.0300 or later.
4. Limit appliance shell, SSH and management access to a small admin group on a management network.
5. If an old appliance was reachable from untrusted networks, hunt as below and rotate vCenter, SSO and ESXi credentials.

### How to check if you are affected

- Review shell histories on the appliance for psql sessions against the VCDB database or queries on vc.vpx_host by anyone other than expected admins.
- Search ESXi /var/log/auth.log for SSH logins as vpxuser, the step Pentera used to take over hosts, and explain each one.
- Check Linux guests and ESXi hosts for the UNC3886 indicators in Mandiant's June 2024 report, such as backdoored /usr/bin/ssh and /usr/sbin/sshd.
- Look for unknown vSphere SSO administrators or local ESXi accounts created since the appliance was last trusted.

## What happened

On March 29, 2022, VMware published [VMSA-2022-0009](https://web.archive.org/web/20221130095900/https://www.vmware.com/security/advisories/VMSA-2022-0009.html) for CVE-2022-22948, an information disclosure bug caused by "improper permission of files" in vCenter Server. VMware said a malicious actor with non-administrative access to vCenter Server could read sensitive data. It rated the bug moderate, CVSS 5.5 with a local vector. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-22948) and CISA score it 6.5 with a network vector. There was no workaround.

Yuval Lazar of Pentera found it. [Pentera's write-up](https://pentera.io/blog/information-disclosure-in-vmware-vcenter/) shows the impact. The file `/etc/vmware-vpx/vcdb.properties` holds the plaintext password for vCenter's PostgreSQL database, and any member of the `cis` group could read it. That database stores an encrypted password for `vpxuser`, the account vCenter uses on every ESXi host it manages. The decryption key in `symkey.dat` needs root, so Pentera chained its earlier privilege escalation, CVE-2021-22015, to get it. It then logged in to ESXi over SSH as vpxuser. One low-privileged foothold on vCenter became control of the hypervisors.

The bug was in no known attacks when it was fixed, and [Tenable](https://tenable.com/blog/cve-2022-22948-vmware-vcenter-server-sensitive-information-disclosure-vulnerability) reported no in-the-wild use at the time. That changed on June 18, 2024. In a [report on UNC3886](https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations), a suspected China-nexus espionage group, Mandiant wrote that CVE-2022-22948 "was exploited to obtain encrypted credentials in the vCenter's postgresDB for further access." The same report says UNC3886 used [CVE-2023-34048](https://www.cve.org/CVERecord?id=CVE-2023-34048) for unauthenticated code execution on vCenter, and collected vpxuser credentials to reach guest VMs. On July 17, 2024, CISA [added the CVE](https://www.cisa.gov/news-events/alerts/2024/07/17/cisa-adds-three-known-exploited-vulnerabilities-catalog) to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948). CISA did not publish its evidence, but Mandiant's report a month earlier is the public record of exploitation.

## Who is affected

According to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2022-22948) and the advisory: vCenter 7.0 before 7.0 U3d, and the 6.7 and 6.5 virtual appliances before 6.7 U3p and 6.5 U3r. Cloud Foundation is fixed in 4.4.1 and 3.11. Windows-based vCenter 6.5 and 6.7 are not affected.

## Do you really need to act?

For this bug alone, most teams patched long ago, so the verdict is check exposure. The attacker needs a shell on the appliance first. UNC3886 is a capable actor that combined it with a remote vCenter bug. The real risk is old appliances. Broadcom ended general support for vCenter 6.5 and 6.7 on October 15, 2022, and for 7.0 on October 2, 2025, according to its [lifecycle note](https://knowledge.broadcom.com/external/article/326984/end-of-general-support-for-vsan-656667.html). vCenter has had more exploited bugs since then. The newest is [CVE-2026-59310](https://www.cve.org/CVERecord?id=CVE-2026-59310), fixed in 8.0 U3k, 9.0.2.0100 and 9.1.0.0300. An appliance that is "patched for 2022-22948" can still be badly out of date.

## What to do now

1. List every vCenter, including those inside Cloud Foundation, and run `vpxd -v` on each appliance to record the build.
2. Upgrade any 6.5, 6.7 or 7.0 appliance to a supported 8.0 or 9.x release. Bring 8.0 and 9.x to the CVE-2026-59310 fixed builds or later.
3. Restrict appliance shell, SSH and management access to a small admin group on a management network.
4. If an old appliance was reachable from untrusted networks, run the checks below and rotate vCenter, SSO and ESXi credentials.

## How to tell if you were hit

- Review appliance shell histories for `psql` sessions against the `VCDB` database, or queries on `vc.vpx_host`, that no admin can explain.
- On ESXi hosts, run `grep vpxuser /var/log/auth.log` and investigate SSH logins as vpxuser. That was the final step in Pentera's chain.
- Check Linux guests and ESXi hosts for the UNC3886 indicators in Mandiant's report, including backdoored `/usr/bin/ssh` and `/usr/sbin/sshd`.

## Timeline

- Mar 29, 2022 — VMware publishes VMSA-2022-0009 and fixed builds; Pentera publishes its analysis.
- May 18, 2022 — Advisory updated with the Cloud Foundation 4.4.1 fix.
- Oct 15, 2022 — End of general support for vCenter 6.5 and 6.7.
- Jun 18, 2024 — Mandiant reports UNC3886 exploited the bug.
- Jul 17, 2024 — CISA adds CVE-2022-22948 to KEV; federal deadline Aug 7, 2024.
- Oct 2, 2025 — End of general support for vCenter 7.0.

## Sources

1. [VMware — VMSA-2022-0009.1: vCenter Server updates address an information disclosure vulnerability (archived copy)](https://web.archive.org/web/20221130095900/https://www.vmware.com/security/advisories/VMSA-2022-0009.html)
2. [Pentera — Mitigating VMware vCenter Information Disclosure (CVE-2022-22948)](https://pentera.io/blog/information-disclosure-in-vmware-vcenter/)
3. [CVE record — CVE-2022-22948](https://www.cve.org/CVERecord?id=CVE-2022-22948)
4. [NVD — CVE-2022-22948](https://nvd.nist.gov/vuln/detail/CVE-2022-22948)
5. [CISA — Known Exploited Vulnerabilities: CVE-2022-22948](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948)
6. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jul 17, 2024)](https://www.cisa.gov/news-events/alerts/2024/07/17/cisa-adds-three-known-exploited-vulnerabilities-catalog)
7. [Mandiant (Google Cloud) — Cloaked and Covert: Uncovering UNC3886 Espionage Operations](https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations)
8. [Broadcom — End of General Support for vSphere 6.5/6.7/7.0](https://knowledge.broadcom.com/external/article/326984/end-of-general-support-for-vsan-656667.html)
9. [CVE record — CVE-2023-34048](https://www.cve.org/CVERecord?id=CVE-2023-34048)
10. [CVE record — CVE-2026-59310](https://www.cve.org/CVERecord?id=CVE-2026-59310)
11. [Tenable — CVE-2022-22948: VMware vCenter Server Sensitive Information Disclosure Vulnerability](https://tenable.com/blog/cve-2022-22948-vmware-vcenter-server-sensitive-information-disclosure-vulnerability)

---
Source page: https://erroneo.us/security/briefs/vcenter-cve-2022-22948-postgres-credential-exposure/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt