VMware vCenter Server vmdir Authentication Bypass and Remote Code Execution Vulnerability (CVE-2020-3952)
Executive & SecOps Summary
SECOPS ASSESSMENTVMware vCenter Server 6.7 deployments (specifically those upgraded from prior versions) containing an embedded or external Platform Services Controller (PSC).
A remote, unauthenticated attacker with network access to vmdir can bypass access controls to extract sensitive directory data or gain full administrative privileges.
Immediately upgrade vCenter Server to version 6.7 Update 3f or later, and restrict network access to the vmdir service.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, upgrade vCenter Server to version 6.7 Update 3f (6.7.0.44000) or later. Use the vCenter Server Appliance (VCSA) shell to execute the update:
# Check and install updates from the official VMware repository
software-packages install --url --acceptEEULA
# Alternatively, install from an attached ISO image
software-packages install --iso --acceptEEULA2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict network access to the vmdir ports (TCP 389 and 636) using firewall rules to allow access only from trusted administrative hosts.
# Restrict access to vmdir LDAP ports using iptables on the vCenter appliance
# Allow trusted admin IP (e.g., 10.0.0.50) and drop all other traffic
iptables -A INPUT -p tcp -s 10.0.0.50 --dport 389 -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.50 --dport 636 -j ACCEPT
iptables -A INPUT -p tcp --dport 389 -j DROP
iptables -A INPUT -p tcp --dport 636 -j DROP3. Log Audit & IoC Verification Commands
Inspect the vmdir logs (/var/log/vmware/vmdir/vmdird-syslog.log) for unauthorized anonymous bind operations or unexpected directory modifications.
# Search for anonymous bind and modification attempts in vmdir logs
grep -i 'Anonymous Bind' /var/log/vmware/vmdir/vmdird-syslog.log
grep -i 'Modify Request' /var/log/vmware/vmdir/vmdird-syslog.log
# Verify the current vCenter Server build version
com.vmware.appliance.version1.system.version.getDetect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-3952) is a critical authentication bypass residing in the VMware Directory Service (vmdir) of VMware vCenter Server. The vmdir service is an LDAP directory service responsible for authentication, licensing, and user management within the vSphere environment. In vCenter Server 6.7 deployments that were upgraded from previous major versions (e.g., 6.0 or 6.5), vmdir fails to properly implement access controls on incoming LDAP requests. This flaw (CWE-306) allows unauthenticated directory access under specific conditions.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates a connection to the vmdir service via TCP port 389 (LDAP) or 636 (LDAPS). While legitimate operations require proper LDAP bind credentials, the vulnerable vmdir implementation permits anonymous binds to perform write operations and schema modifications. By exploiting this behavior, an attacker can inject arbitrary directory entries, add unauthorized accounts to the 'Administrators' group, or modify existing directory objects, effectively achieving complete administrative control over the vCenter Server and the managed ESXi infrastructure.
3. Infrastructure & Business Impact
Since vCenter Server acts as the central management plane for virtualized enterprise infrastructure, compromise of this component has catastrophic consequences. Attackers gaining administrative access can control virtual machines, exfiltrate sensitive data, alter virtual networking, or delete backups. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and carries an EPSS score exceeding 0.90, indicating active exploitation in the wild and a high probability of attack.
Official Vendor Advisories & References
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
Frequently Asked SecOps Questions (CVE-2020-3952)
FAQQ1. How critical is CVE-2020-3952 and is it actively exploited in the wild?
CVE-2020-3952 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 90.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-3952?
Primary impacted vendors include vmware across vcenter_server. Scope summary: VMware vCenter Server 6.7 (only deployments upgraded from prior versions where vmdir is active)
Q3. What temporary mitigations or workarounds exist for CVE-2020-3952 before patching?
[Mitigation] Immediately upgrade vCenter Server to version 6.7 Update 3f or later, and restrict network access to the vmdir service. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-3952
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.