CVE-2022-22952

9.1 criticalEPSS 1.5%

VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2022-03-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vmware:carbon_black_app_control

References

https://www.vmware.com/security/advisories/VMSA-2022-0008.html
https://www.vmware.com/security/advisories/VMSA-2022-0008.html

Check your stack JSON