CVE-2020-3976

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-21 · updated 2026-06-17
Weakness: CWE-400

Description

VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.

Affected products

VMware Cloud Foundation: from 3.0 before 3.10; from 4.0 before 4.0.1 — fixed in 3.10, 4.0.1
VMware ESXi: 6.5-650-201701001, 6.5-650-201703001, 6.5-650-201703002, 6.5-650-201704001, 6.5-650-201707101, 6.5-650-201707102 (+181); 6.5, 6.7, 7.0
VMware vCenter Server: 6.5-a, 6.5-b, 6.5-c, 6.5-d, 6.5-e, 6.5-f (+28); 6.5, 6.7, 7.0
ESXi, vCenter Server, and Cloud Foundation: ESXi 7.0, 6.7, 6.5, vCenter Server 7.0, 6.7, 6.5, and Cloud Foundation 4.x.x, and 3.x.x release lines.

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 3.10, 4.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3976 or the next vulnerability affects your stack