CVE-2020-3955: VMware ESXi

Critical severity, CVSS 9.3. EPSS: 1.3% chance of exploitation in the next 30 days.

ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.3.

Affected products

• VMware ESXi: version 6.5 only; version 6.7 only

Published 2020-04-29. Last modified 2026-06-17.