Is CVE-2022-35508 actively exploited?

No active exploitation of CVE-2022-35508 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-35508 be exploited remotely?

Yes. CVE-2022-35508 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-35508?

CVE-2022-35508 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2022-35508

CRITICAL

CVE-2022-35508

CWE-918Published: December 4, 2022· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.

NVD Source

Risk Analysis

Proxmox Virtual Environment and Mail Gateway are vulnerable to Server-Side Request Forgery (SSRF) and potential privilege escalation to root. This critical flaw allows unprivileged users to access files or escalate privileges if specific backup configurations exist. It is not in the CISA KEV.

No public exploit is known for this vulnerability. It is remotely exploitable.

Recommended Action

Update to pve-http-server 4.1-3 or later and ensure backup files are secured with appropriate permissions.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-35508 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.