VS
Virtualization
vCenter Server
On CISA KEVExploited in the wildRansomware-linked
86
CVEs
12
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 26Medium 25Low 0
Watch
Add vCenter Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59310 RansomwareIn wildKEV | 9.8 | Jul 30 | vCenter directory-traversal vulnerability Affected: 9.1.x.x before 9.1.0.0300; 9.0.x.x before 9.0.2.0100; 8.0 before 8.0 U3k |
| CVE-2024-38813 In wildKEV | 9.8 | Sep 17 | Privilege escalation vulnerability Affected: 8.0 before 8.0 U3b; 7.0 before 7.0 U3s |
| CVE-2024-38812 In wildKEV | 9.8 | Sep 17 | Heap-overflow vulnerability Affected: 8.0 before 8.0 U3b; 7.0 before 7.0 U3s |
| CVE-2024-37079 In wildKEV | 9.8 | Jun 18 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability Affected: 8.0 before 8.0 U2d; 8.0 before 8.0 U1e; 7.0 before 7.0 U3r |
| CVE-2023-34048 In wildKEV | 9.8 | Oct 25 | VMware vCenter Server Out-of-Bounds Write Vulnerability Affected: 8.0 before 8.0U2; 7.0 before 7.0U3o |
| CVE-2021-22005 RansomwareIn wildKEV | 9.8 | Sep 23 | VMware vCenter Server File Upload Vulnerability Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21985 RansomwareIn wildKEV | 9.8 | May 26 | VMware vCenter Server Improper Input Validation Vulnerability Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2021-21972 RansomwareIn wildKEV | 9.8 | Feb 24 | VMware vCenter Server Remote Code Execution Vulnerability Affected: 7.x before 7.0 U1c; 6.7 before 6.7 U3l; 6.5 before 6.5 U3n |
| CVE-2020-3952 In wildKEV | 9.8 | Apr 10 | VMware vCenter Server Information Disclosure Vulnerability Affected: vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected. |
| CVE-2026-59309 | 9.8 | Jul 30 | vCenter authentication-bypass vulnerability Affected: 9.1.x.x before 9.1.0.0300; 9.0.x.x before 9.0.2.0100; 8.0 before 8.0 U3k |
| CVE-2024-37080 | 9.8 | Jun 18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol Affected: 8.0; 8.0; 8.0; 8.0; 8.0; 8.0; +34 more |
| CVE-2023-20895 | 9.8 | Jun 22 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2023-20894 | 9.8 | Jun 22 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2023-20893 | 9.8 | Jun 22 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2023-20892 | 9.8 | Jun 22 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network… Affected: before 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +27 more |
| CVE-2021-22049 | 9.8 | Nov 24 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in Affected: 6.5; 6.7; 7.0 |
| CVE-2021-21986 | 9.8 | May 26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware… Affected: 6.5; 6.5; 6.5; 6.5; 6.5; 6.5; +34 more |
| CVE-2017-4923 | 9.8 | Aug 1 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability Affected: 6.5 |
| CVE-2022-31680 | 9.1 | Oct 7 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller) Affected: VMware vCenter Server 6.5 prior to U3u |
| CVE-2017-4919 | 9.0 | Jul 28 | VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to… Affected: 5.5; 6.0; 6.5 |
Showing 20