STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter Server must terminate vSphere Client sessions after 15 minutes of inactivity.

DISA Rule

SV-258920r1015932_rule

Vulnerability Number

V-258920

Group Title

SRG-APP-000190

Rule Version

VCSA-80-000089

Severity

CAT II

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-004895 - Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

Weight

10

Fix Recommendation

From the vSphere Client, go to Administration >> Deployment >> Client Configuration.

Click "Edit" and enter "15" minutes into the "Session timeout" setting. Click "Save".

Check Contents

From the vSphere Client, go to Administration >> Deployment >> Client Configuration.

View the value of the "Session timeout" setting.

If the "Session timeout" is not set to "15 minute(s)" or less, this is a finding.

Vulnerability Number

V-258920

Documentable

False

Rule Version

VCSA-80-000089

Severity Override Guidance

From the vSphere Client, go to Administration >> Deployment >> Client Configuration.

View the value of the "Session timeout" setting.

If the "Session timeout" is not set to "15 minute(s)" or less, this is a finding.

Check Content Reference

M

Target Key

5573