VS
Virtualization
vCenter Server
On CISA KEVExploited in the wildRansomware-linked
86
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 26Medium 25Low 0
Watch
Add vCenter Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59310 RansomwareIn wildKEV | 9.8 | Jul 30 | vCenter directory-traversal vulnerability Affected: 9.1.x.x before 9.1.0.0300; 9.0.x.x before 9.0.2.0100; 8.0 before 8.0 U3k |
| CVE-2024-38813 In wildKEV | 9.8 | Sep 17 | Privilege escalation vulnerability Affected: 8.0 before 8.0 U3b; 7.0 before 7.0 U3s |
| CVE-2024-38812 In wildKEV | 9.8 | Sep 17 | Heap-overflow vulnerability Affected: 8.0 before 8.0 U3b; 7.0 before 7.0 U3s |
| CVE-2024-37079 In wildKEV | 9.8 | Jun 18 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability Affected: 8.0 before 8.0 U2d; 8.0 before 8.0 U1e; 7.0 before 7.0 U3r |
| CVE-2023-34048 In wildKEV | 9.8 | Oct 25 | VMware vCenter Server Out-of-Bounds Write Vulnerability Affected: 8.0 before 8.0U2; 7.0 before 7.0U3o |
| CVE-2021-22005 RansomwareIn wildKEV | 9.8 | Sep 23 | VMware vCenter Server File Upload Vulnerability Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21985 RansomwareIn wildKEV | 9.8 | May 26 | VMware vCenter Server Improper Input Validation Vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-21972 RansomwareIn wildKEV | 9.8 | Feb 24 | VMware vCenter Server Remote Code Execution Vulnerability Affected: 7.x before 7.0 U1c; 6.7 before 6.7 U3l; 6.5 before 6.5 U3n |
| CVE-2020-3952 In wildKEV | 9.8 | Apr 10 | VMware vCenter Server Information Disclosure Vulnerability Affected: vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected. |
| CVE-2022-22948 In wildKEV | 6.5 | Mar 29 | VMware vCenter Server Incorrect Default File Permissions Vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-22017 In wildKEV | 5.3 | Sep 23 | VMware vCenter Server Improper Access Control Affected: 6.7 |
| CVE-2021-21973 In wildKEV | 5.3 | Feb 24 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability Affected: 7.x before 7.0 U1c; 6.7 before 6.7 U3l; 6.5 before 6.5 U3n |
| CVE-2026-59309 | 9.8 | Jul 30 | vCenter authentication-bypass vulnerability Affected: 9.1.x.x before 9.1.0.0300; 9.0.x.x before 9.0.2.0100; 8.0 before 8.0 U3k |
| CVE-2024-37080 | 9.8 | Jun 18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol Affected: 8.0; 8.0; 8.0; 8.0; 8.0; 8.0; +34 more |
| CVE-2023-20895 | 9.8 | Jun 22 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2023-20894 | 9.8 | Jun 22 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2023-20893 | 9.8 | Jun 22 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2023-20892 | 9.8 | Jun 22 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2021-22049 | 9.8 | Nov 24 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21986 | 9.8 | May 26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4923 | 9.8 | Aug 1 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability Affected: 6.5 |
| CVE-2022-31680 | 9.1 | Oct 7 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller) Affected: VMware vCenter Server 6.5 prior to U3u |
| CVE-2017-4919 | 9.0 | Jul 28 | VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to… Affected: 5.5; 6.0; 6.5 |
| CVE-2021-22048 | 8.8 | Nov 10 | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism Affected: 6.5; 6.7; 7.0 |
| CVE-2017-4921 | 8.8 | Aug 1 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner Affected: 6.5 |
| CVE-2024-37081 | 7.8 | Jun 18 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may… Affected: 8.0; 8.0; 8.0; 8.0; 8.0; 8.0; +34 more |
| CVE-2021-22015 | 7.8 | Sep 23 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21991 | 7.8 | Sep 22 | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4943 | 7.8 | Dec 20 | VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +3 more |
| CVE-2009-2698 | 7.8 | Aug 27 | The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a… Affected: 4.0 |
| CVE-2019-5534 | 7.7 | Sep 18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2019-5532 | 7.7 | Sep 18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in… Affected: 6.0; 6.0; 6.0; 6.0; 6.0; 6.0; +34 more |
| CVE-2016-7459 | 7.7 | Dec 29 | VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3)… Affected: 5.0; 5.5; 5.5; 5.5; 5.5; 5.5; +7 more |
| CVE-2016-2076 | 7.6 | Apr 15 | Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before… Affected: through 6.0; 5.5; 5.5; 5.5 |
| CVE-2023-20896 | 7.5 | Jun 22 | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… Affected: 4.0 before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2022-22982 | 7.5 | Jul 13 | The vCenter Server contains a server-side request forgery (SSRF) vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-21980 | 7.5 | Nov 24 | The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +29 more |
| CVE-2021-22019 | 7.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service Affected: 6.5; 6.7; 7.0 |
| CVE-2021-22013 | 7.5 | Sep 23 | The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API Affected: 6.7; 7.0 |
| CVE-2021-22012 | 7.5 | Sep 23 | The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API Affected: 6.7; 7.0 |
| CVE-2021-22010 | 7.5 | Sep 23 | The vCenter Server contains a denial-of-service vulnerability in VPXD service Affected: 6.7; 7.0 |
| CVE-2021-22009 | 7.5 | Sep 23 | The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service Affected: 6.7; 7.0 |
| CVE-2021-22008 | 7.5 | Sep 23 | The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service Affected: 6.5; 6.7; 7.0 |
| CVE-2021-22006 | 7.5 | Sep 23 | The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI Affected: 6.7; 7.0 |
| CVE-2017-4928 | 7.5 | Nov 17 | The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e Affected: 5.5; 5.5; 5.5; 5.5; 5.5; 5.5; +21 more |
| CVE-2017-4927 | 7.5 | Nov 17 | VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service Affected: 6.0 before 6.0_u3c; 6.5 before 6.5_u1 |
| CVE-2020-3994 | 7.4 | Oct 20 | VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +23 more |
| CVE-2024-22274 | 7.2 | May 21 | The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this… Affected: 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +34 more |
| CVE-2021-22014 | 7.2 | Sep 23 | The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure) Affected: 6.5; 6.7; 7.0 |
| CVE-2021-22018 | 6.5 | Sep 23 | The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in Affected: 7.0 |