VMware vRealize Orchestrator vulnerabilities

3 CVEs affecting VMware vRealize Orchestrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-20855, published 2023-02-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-6934, published 2015-12-21. High severity, CVSS 7.3. EPSS: 5% chance of exploitation in the next 30 days. Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow…
CVE-2023-20855, published 2023-02-22. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted…
CVE-2021-22036, published 2021-10-13. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled…