Veille CVE

Recherche « Vmware vsphere »

11 CVE

Critique 5 Élevée 3 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Vmware vsphere » ✕
  1. CVE-2026-67261 9.8 Critique

    Dell Virtual Storage Integrator for VMware vSphere Client · Dell virtual storage integrator

    Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.

  2. CVE-2026-54489 9.8 Critique

    Dell Virtual Storage Integrator for VMware vSphere Client · Dell virtual storage integrator

    Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session credentials and fully impersonate authenticated users, including administrators. Dell recommends customers to upgrade at the earliest opportunity.

  3. CVE-2026-41709 2.7 Faible

    VMware Cloud Foundation · VMware vSphere Foundation · VMware ESX · VMware Telco Cloud Platform

    VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

  4. CVE-2026-59310 9.8 Critique Exploitée Rançongiciel

    VMware Cloud Foundation · VMware vSphere Foundation · VMware vCenter · VMware Telco Cloud Infrastructure

    VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

  5. CVE-2026-59309 9.8 Critique

    VMware Cloud Foundation · VMware vSphere Foundation · VMware vCenter · VMware Telco Cloud Infrastructure

    VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

  6. CVE-2026-47876 9.3 Critique

    VMware Cloud Foundation · VMware vSphere Foundation · VMware ESX · VMware Telco Cloud Platform

    VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

  7. CVE-2026-41703 7.6 Élevée

    VMware Cloud Foundation · VMware vSphere Foundation · VMware ESX · VMware Workstation

    VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

  8. CVE-2026-41723 8.0 Élevée

    VMware VCF operations · VMware Aria Operations · VMware Telco Cloud Platform · Vmware cloud foundation

    VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

  9. CVE-2026-41722 5.4 Moyenne

    VMware VCF operations · VMware Aria Operations · VMware Telco Cloud Platform · Vmware cloud foundation

    VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

  10. CVE-2024-37085 7.2 Élevée Exploitée Rançongiciel

    vmware esxi · VMware Cloud Foundation · vmware cloud_foundation

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

  11. CVE-2021-21973 5.3 Moyenne Exploitée

    VMware vCenter Server · VMware Cloud Foundation

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).