VMware vCenter vulnerabilities

7 CVEs affecting VMware vCenter, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-41250, published 2025-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-0778, published 2009-03-12. High severity, CVSS 7.1. EPSS: 4.6% chance of exploitation in the next 30 days. The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka…
CVE-2009-3731, published 2009-12-16. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x;…
CVE-2011-0426, published 2011-05-09. Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote attackers to read…
CVE-2011-1789, published 2011-05-09. Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days. The self-extracting installer in the vSphere Client Installer package in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, VMware ESXi 4.x before 4.1 Update 1, and VMware ESX 4.x before 4.1…
CVE-2025-41250, published 2025-09-29. High severity, CVSS 8.5. EPSS: 0.6% chance of exploitation in the next 30 days. VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate…
CVE-2011-1788, published 2011-05-09. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1 allows local users to discover the SOAP session ID via unspecified vectors.
CVE-2025-41241, published 2025-07-29. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this…