CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- VMware ESXi OpenSLP Use-After-Free Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
Affected products
vmware: cloud foundation; vmware: esxi
References7
- www.vmware.com/security/advisories/VMSA-2020-0023.html PatchVendor Advisory
- www.vmware.com/security/advisories/VMSA-2020-0023.html PatchVendor Advisory
- www.zerodayinitiative.com/advisories/ZDI-20-1377/ Third Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-20-1385/ Third Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-20-1377/ Third Party AdvisoryVDB Entry
- www.zerodayinitiative.com/advisories/ZDI-20-1385/ Third Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 83% percentile: 100 · as of 11 November 2026
- CWE
- CWE-416
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.