VMware vCenter Server vulnerabilities
We track 11 vulnerabilities in VMware vCenter Server products. 10 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on September 17, 2024.
Latest VMware vCenter Server vulnerabilities
- 9.8 Critical severity
VMware vCenter Server Privilege Escalation Exploited
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- 9.8 Critical severity
VMware vCenter Server Heap-Based Buffer Overflow Exploited
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to
- 7.8 High severity
VMware vCenter Server: ASP.NET Misconfiguration: Use of Identity Impersonation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
- 9.8 Critical severity
VMware vCenter Server: Out-of-bounds Write
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remo
- 9.8 Critical severity
Broadcom VMware vCenter Server Out-of-bounds Write Exploited
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remo
- 7.2 High severity
VMware vCenter Server: Improper Control of Generation of Code
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
- 9.1 Critical severity
VMware vCenter Server: Deserialization of Untrusted Data
The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts
- 7.5 High severity
VMware vCenter Server: Server-Side Request Forgery
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
- 5.3 Medium severity
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Exploited
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter
- 9.8 Critical severity
VMware vCenter Server Remote Code Execution Exploited
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system t
- 9.8 Critical severity
VMware vCenter Server Information Disclosure Exploited
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.