n/a VMware vCenter Server

Name: n/a VMware vCenter Server
Brand: n/a

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

7critical3high1medium0low

updated 2026-10-27

vulnerabilities (14)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-21972US	critical9.8OT critical	99.9% (100th)	KEV	no fix	2021-02-24	3 versions
CVE-2020-3952US	critical9.8OT critical	90.4% (100th)	KEV	no fix	2020-04-10	≤ vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952 if it was upgraded from a previous release line such as 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected.
CVE-2021-21973US	medium5.3OT critical	88.0% (100th)	KEV	no fix	2021-02-24	3 versions
CVE-2024-38812US	critical9.8OT critical	54.6% (99th)	KEV	8.0 U3b	2024-09-17	2 versions
CVE-2024-37079US	critical9.8OT critical	22.4% (98th)	KEV	8.0 U1e	2024-06-18	3 versions
CVE-2024-38813US	critical9.8OT critical	17.4% (97th)	KEV	8.0 U3b	2024-09-17	2 versions
CVE-2024-37081US	—	4.99% (92nd)	Exploit	8.0 U2d	2024-06-18	2 versions
CVE-2024-22274US	—	2.51% (85th)	Exploit	8.0 U2b	2024-05-21	2 versions
CVE-2024-22275US	—	0.99% (62nd)	Exploit	8.0 U2b	2024-05-21	2 versions
CVE-2022-31680US	critical9.1	33.3% (98th)	—	no fix	2022-10-07	≤ VMware vCenter Server 6.5 prior to U3u
CVE-2024-37080US	critical9.8	12.5% (96th)	—	7.0 U3r	2024-06-18	3 versions
CVE-2021-22013US	high7.5	1.65% (76th)	—	no fix	2021-09-23	≤ VMware vCenter Server 6.5 before 6.5 U3q
CVE-2021-22012US	high7.5OT elevated	1.38% (72nd)	—	no fix	2021-09-23	≤ VMware vCenter Server 6.5 before 6.5 U3q
CVE-2022-22982US	high7.5	1.04% (64th)	—	no fix	2022-07-13	≤ VMware vCenter Server (7.0 before 7.0 U3f, 6.7 before 6.7 U3r & 6.5 before 6.5 U3t)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow3 CVEs
CWE-787Out-of-bounds Write3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-287Improper Authentication2 CVEs
CWE-306Missing Authentication for Critical Function2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.