CVE-2020-5396

8.8 highEPSS 1.9%

High (8.8) in vmware. EPSS 1.9% chance of exploitation in the next 30 days.

VMware GemFire versions prior to 9.10.0, 9.9.2, 9.8.7, and 9.7.6, and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2, when deployed without a SecurityManager, contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWEs: CWE-862, CWE-284
Published: 2020-07-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

vmware:gemfire
vmware:tanzu_gemfire_for_virtual_machines

References

https://tanzu.vmware.com/security/cve-2020-5396
https://tanzu.vmware.com/security/cve-2020-5396

Check your stack JSON