Skip to main content

VMware Releases Security Updates for vCenter Version 7.x

VMware has released out-of-band updates to address the Log4Shell vulnerability in vCenter Server 7.x

Threat ID:
CC-4026
Threat Severity:
High
Published:
28 January 2022 12:42 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

VMware has released out-of-band updates to address the Log4Shell vulnerability in vCenter Server 7.x

Affected platforms

The following platforms are known to be affected:

Versions: 7.0 prior to 7.0 Update 3 c

VMware vCenter Server

Threat details

Future vCenter alerts

Please note this alert only relates to vCenter Server 7.x. Future alerts will cover other vCenter Server versions as and when patches are released by VMware.

Introduction

VMware has released out-of-band security updates to address the Log4Shell vulnerabilities in their vCenter Server management software. They claim that an unauthenticated remote attacker could exploit these vulnerabilities to take control of an affected vCenter Server instance.

NHS Digital response to Log4Shell

This alert is part of NHS Digital's wider response to Log4Shell. For more information on Log4Shell itself, please visit our cyber alerts article Log4Shell RCE Vulnerability CC-3989.

NHS and social care organisations are invited to use the Cyber Associates Network to find out additional information and participate in discussion about the Log4Shell remote code execution vulnerability and affected products.

VMware vCenter Products Under Active Exploitation

The Log4Shell vulnerability within VMware vCenter products is being actively targeted and exploited. VMware products have been targeted by advanced persistent threat groups historically.

Remediation advice

Affected organisations are encouraged to review VMware's vCenter 7.0 Update 3 C Release Notes and apply the relevant updates immediately.

Last edited: 28 January 2022 12:42 pm