CVE-2019-5523: VMware Vcloud Director

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.

Affected products

• VMware Vcloud Director: from 9.5.0.0, before 9.5.0.3 (fixed in 9.5.0.3)

Published 2019-04-01. Last modified 2026-06-17.