CVE-2011-4404: VMware vCenter Update Manager

Medium severity, CVSS 5.0. EPSS: 58.9% chance of exploitation in the next 30 days.

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523.

Affected products

• VMware vCenter Update Manager: version 4.0 only; version 4.1 only

Published 2011-11-19. Last modified 2026-06-16.