CVE-2015-6934

Severity: high (CVSS 7.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-12-21 · updated 2026-06-17
Weakness: CWE-20

Description

Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Affected products

VMware Vcenter Orchestrator: 5.5, 5.5.1, 5.5.2, 5.5.2.1
VMware Vrealize Orchestrator: 6.0.1, 6.0.2, 6.0.3

References

http://www.securityfocus.com/bid/79648
http://www.vmware.com/security/advisories/VMSA-2015-0009.html
http://www.securityfocus.com/bid/79648
http://www.vmware.com/security/advisories/VMSA-2015-0009.html

Get alerted when CVE-2015-6934 or the next vulnerability affects your stack