CVSS 3.0
7.6 highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:LCVE-2016-2076
High (7.6) in vmware. EPSS 1.4% chance of exploitation in the next 30 days.
Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:vcenter_server
- vmware:vcloud_automation_identity_appliance
- vmware:vcloud_director