VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a…
Severity
Medium 5.4
Published
18 Sept 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1% in the next 30 daysHigher than 62% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
VMware vCenter ServerServers and applications · cpe:a:vmware:vcenter_server
Version 6.7-update2
Version 6.7-update1
Version 6.7-d
Version 6.7
All 44 release lines
Version 6.0-a
Version 6.0-b
Version 6.0-u1b
Version 6.0-update2a
Version 6.0-update3a
Version 6.0-update3b
Version 6.0-update3c
Version 6.0
Version 6.0-u1
Version 6.0-u3
Version 6.0-update2
Version 6.0-update2m
Version 6.0-update3d
Version 6.0-update3e
Version 6.0-update3f
Version 6.0-update3g
Version 6.0-update3h
Version 6.0-update3i
Version 6.5-a
Version 6.5-b
Version 6.5-c
Version 6.5-update1b
Version 6.5-update1c
Version 6.5-update2b
Version 6.5-update2c
Version 6.5
Version 6.5-d
Version 6.5-update1
Version 6.5-update1d
Version 6.5-update1e
Version 6.5-update1g
Version 6.5-update2
Version 6.5-update2d
Version 6.5-update2g
Version 6.7-a
Version 6.7-b
Version 6.7-c
Version 6.7-update1b
Version 6.7-update2a
Version 6.7-update2c
Version 6.7
Version 6.7-d
Version 6.7-update1
Version 6.7-update2
VMware ESXiServers and applications · cpe:o:vmware:esxi