VMware Vcenter Server
81 CVEs affecting VMware Vcenter Server. Latest disclosed: 2026-07-30. Critical: 15, High: 30.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59310 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to ex… |
CVE-2026-59309 | Critical | 9.8 | 2026-07-30 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit th… |
CVE-2024-38812 | Critical | 9.8 | 2024-09-17 | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server… |
CVE-2024-37080 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2024-37079 | Critical | 9.8 | 2024-06-18 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may… |
CVE-2023-34048 | Critical | 9.8 | 2023-10-25 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Ser… |
CVE-2021-22049 | Critical | 9.8 | 2021-11-24 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor wi… |
CVE-2021-22005 | Critical | 9.8 | 2021-09-23 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Serve… |
CVE-2021-21986 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Ma… |
CVE-2021-21985 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab… |
CVE-2021-21972 | Critical | 9.8 | 2021-02-24 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exp… |
CVE-2020-3952 | Critical | 9.8 | 2020-04-10 | Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctl… |
CVE-2017-4923 | Critical | 9.8 | 2017-08-01 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when us… |
CVE-2022-31680 | Critical | 9.1 | 2022-10-07 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter s… |
CVE-2017-4919 | Critical | 9.0 | 2017-07-28 | VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without… |
CVE-2021-22048 | High | 8.8 | 2021-11-10 | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor wit… |
CVE-2017-4921 | High | 8.8 | 2017-08-01 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe mann… |
CVE-2023-20895 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCe… |
CVE-2023-20894 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to… |
CVE-2023-20893 | High | 8.1 | 2023-06-22 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCente… |