Vmware Vcenter Server vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Vmware Vcenter Server: 13 record(s), with affected versions and fixes.cpe:2.3:a:vmware:vcenter_server
CVE-2026-59309
Critical · 9.8
CWE-303 Jul 30, 2026
vCenter authentication-bypass vulnerability
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
CVE-2026-59310
Critical · 9.8
KEV Urgent · 77 Public exploit Ransomware CWE-22 Jul 30, 2026
Broadcom VMware vCenter Path Traversal Vulnerability
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
CVE-2024-38813
Critical · 9.8
KEV High · 60 CWE-273 Sep 17, 2024
VMware vCenter Server Privilege Escalation Vulnerability
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
CVE-2024-38812
Critical · 9.8
KEV High · 63 CWE-787 Sep 17, 2024
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2024-37079
Critical · 9.8
KEV High · 63 CWE-787 Jun 18, 2024
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
CVE-2023-34048
Critical · 9.8
KEV Urgent · 74 Public exploit CWE-787 Oct 25, 2023
VMware vCenter Server Out-of-Bounds Write Vulnerability
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
CVE-2022-22948
Medium · 6.5
KEV High · 68 Public exploit CWE-276 Mar 29, 2022
VMware vCenter Server Incorrect Default File Permissions Vulnerability
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
CVE-2021-22017
Medium · 5.3
KEV High · 60 Public exploit Sep 23, 2021
VMware vCenter Server Improper Access Control
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
CVE-2021-22005
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-22 Sep 23, 2021
VMware vCenter Server File Upload Vulnerability
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
CVE-2021-21985
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-918 May 26, 2021
VMware vCenter Server Improper Input Validation Vulnerability
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVE-2021-21972
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-22 Feb 24, 2021
VMware vCenter Server Remote Code Execution Vulnerability
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVE-2021-21973
Medium · 5.3
KEV High · 66 Public exploit CWE-918 Feb 24, 2021
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVE-2020-3952
Critical · 9.8
KEV Urgent · 83 Public exploit CWE-306 Apr 10, 2020
VMware vCenter Server Information Disclosure Vulnerability
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.