CVE-2016-7458

5.8 mediumEPSS 1.2%

VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Severity

CVSS 3.0

5.8 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2016-12-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vmware:vsphere_client

References

http://www.securityfocus.com/bid/94483
http://www.securitytracker.com/id/1037328
http://www.vmware.com/security/advisories/VMSA-2016-0022.html
http://www.securityfocus.com/bid/94483
http://www.securitytracker.com/id/1037328

Check your stack JSON