vCenter Server vulnerabilitiesAnd the versions its exploited flaws hit.
vCenter Server is made by VMware. We track 75 published vulnerabilities listed under that exact name, across 16 versions. 11 of them are on the list of flaws known to be exploited, the newest added on 23 January 2026. VMware lists newer releases under their own names, such as Vcenter Server Appliance, so check those pages too.
The most recent vCenter Server flaw added to the known-exploited list is CVE-2024-37079, on 23 January 2026. We keep watching the known-exploited list.
Is vCenter Server listed under other names? Yes.
VMware also lists vCenter Server under more specific names, such as Vcenter Server Appliance. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of vCenter Server do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2024-37079Exploited list, 23 Jan 2026
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
7.0-a7.0-b7.07.0-c7.0-d7.0-update1a7.0-update17.0-update1c - CVE-2024-38813Exploited list, 20 Nov 2024
VMware vCenter Server Privilege Escalation Vulnerability
7.0-a7.0-b7.07.0-c7.0-d7.0-update1a7.0-update17.0-update1c - CVE-2024-38812Exploited list, 20 Nov 2024
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
7.0-a7.0-b7.07.0-c7.0-d7.0-update1a7.0-update17.0-update1c - CVE-2022-22948Exploited list, 17 Jul 2024
VMware vCenter Server Incorrect Default File Permissions Vulnerability
6.5-a6.5-b6.56.5-c6.5-d6.5-e6.5-f6.5-update1b - CVE-2023-34048Exploited list, 22 Jan 2024
VMware vCenter Server Out-of-Bounds Write Vulnerability
4.0 to 5.57.0-a7.0-b7.07.0-c7.0-d7.0-update1a7.0-update1 - CVE-2021-21973Exploited list, 7 Mar 2022
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
6.5-a6.5-b6.56.5-c6.5-d6.5-e6.5-f6.5-update1d - CVE-2021-22017Exploited list, 10 Jan 2022
VMware vCenter Server Improper Access Control
6.7 - CVE-2020-3952Exploited list, 3 Nov 2021
VMware vCenter Server Information Disclosure Vulnerability
6.7 - CVE-2021-22005Exploited list, 3 Nov 2021
VMware vCenter Server File Upload Vulnerability
6.56.77.0 - CVE-2021-21985Exploited list, 3 Nov 2021
VMware vCenter Server Improper Input Validation Vulnerability
6.5-a6.5-b6.56.5-c6.5-d6.5-e6.5-f6.5-update1b - CVE-2021-21972Exploited list, 3 Nov 2021
VMware vCenter Server Remote Code Execution Vulnerability
6.5-a6.5-b6.56.5-c6.5-d6.5-e6.5-f6.5-update1d
Which vCenter Server vulnerabilities are being exploited?
11 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.
- 7.5VMware vCenter Server Privilege Escalation Vulnerability
VMware vCenter contains an improper check for dropped privileges vulnerability.
- 9.8VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol.
- 6.5VMware vCenter Server Incorrect Default File Permissions Vulnerability
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
- 9.8VMware vCenter Server Out-of-Bounds Write Vulnerability
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
- 5.3VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin.
- 5.3VMware vCenter Server Improper Access Control
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
- 9.8VMware vCenter Server Information Disclosure Vulnerability
VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls.
Which vCenter Server flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server.
- >99%
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.
- >99%
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.
- >99%
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.
- 90%
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- 88%
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin.
- 55%
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.
- 49%
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
- 48%CVE-2022-31698Medium
The vCenter Server contains a denial-of-service vulnerability in the content library service.
Running vCenter Server? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
- Matched to
- vCenter Server on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 75 published vulnerabilities listed under the name vCenter Server, across 16 versions. The most recent vCenter Server flaw added to the known-exploited list is CVE-2024-37079, on 23 January 2026.
11 are on the list of flaws known to be exploited. The most recently added are CVE-2024-37079, CVE-2024-38813 and CVE-2024-38812.
VMware also lists vCenter Server under more specific names, such as Vcenter Server Appliance. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2024-37079, affects 7.0-a, 7.0-b, 7.0, 7.0-c and more. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track vCenter Server. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.