CVE-2022-31704: VMware vRealize Log Insight broken access control leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS probability make this a top-priority patch.

What it is

vRealize Log Insight contains a broken access control flaw that lets an unauthenticated remote actor inject code into sensitive files on the appliance. Successful injection results in remote code execution on the impacted appliance. The flaw is rated critical (CVSS 9.8) and has a very high EPSS probability, so it warrants prompt attention.

Impact

An attacker gains remote code execution on the log insight appliance, which can lead to full compromise of the appliance and any data or credentials it holds. Because no authentication is required, the attacker does not need prior access.

Attack surface

Reachable over the network via the appliance's exposed interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.81011 (99.6th percentile), indicating a high likelihood of exploitation activity. Public exploit material is referenced via Packet Storm, though the record does not confirm active in-the-wild exploitation.

What to do

• Apply the vendor patch from VMware advisory VMSA-2023-0001 as the first action.
• If patching cannot be done immediately, restrict network access to the vRealize Log Insight interface to trusted management networks only.
• Place the appliance behind a firewall or reverse proxy and block untrusted inbound access to its management and API ports.
• Monitor the appliance for unexpected file changes in sensitive paths and review logs for anomalous write or execution activity.
• Rotate credentials and secrets stored or processed by the appliance if compromise is suspected.

Detection

• Monitor for unexpected modifications to sensitive files on the vRealize Log Insight appliance.
• Alert on suspicious process execution or child processes spawned by the appliance's web or application services.
• Review network logs for unauthenticated requests to the appliance's management interface from untrusted sources.
• Correlate appliance logs with file integrity monitoring alerts for writes outside normal operational patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.