CVE-2020-3994

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-20 · updated 2026-06-17
Weakness: CWE-295

Description

VMware vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k) contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repository may be able to perform a session hijack when the vCenter Server Appliance Management Interface is used to download vCenter updates.

Affected products

VMware Cloud Foundation: from 3.0 before 3.9 — fixed in 3.9
VMware vCenter Server: 6.5, 6.5-a, 6.5-b, 6.5-c, 6.5-d, 6.5-e (+23)
vCenter Server: vCenter Server (6.7 before 6.7u3, 6.6 before 6.5u3k)

How to fix

Upgrade to a fixed version: VMware Cloud Foundation 3.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3994 or the next vulnerability affects your stack