CVE-2017-4947

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-29 · updated 2026-06-17
Weakness: CWE-502

Description

VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful exploitation of this issue may allow remote attackers to execute arbitrary code on the appliance.

Affected products

VMware vRealize Automation: 7.2.0, 7.3.0
VMware vSphere Integrated Containers: before 1.3.0 — fixed in 1.3.0
VMware vRealize Automation: 7.3 and 7.2
VMware vSphere Integrated Containers: 1.x before 1.3

How to fix

Upgrade to a fixed version: VMware vSphere Integrated Containers 1.3.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/102852
http://www.securitytracker.com/id/1040289
http://www.securitytracker.com/id/1040290
https://www.vmware.com/security/advisories/VMSA-2018-0006.html
http://www.securityfocus.com/bid/102852
http://www.securitytracker.com/id/1040289
http://www.securitytracker.com/id/1040290
https://www.vmware.com/security/advisories/VMSA-2018-0006.html

Get alerted when CVE-2017-4947 or the next vulnerability affects your stack