CVE-2008-4281: Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX35...

Security readout for executives and security teams

CVE-2008-4281 affects legacy VMware ESX/ESXi 3.5 systems. An administrator who already has Datastore.FileManagement privilege could use a directory traversal flaw to gain additional privileges. The issue is old, but virtualization hosts are high-value infrastructure, so any remaining ESX/ESXi 3.5 estate deserves prompt review. Exposure is most likely in organizations still running VMware ESX 3.5 or ESXi 3.5, especially where administrators or service accounts have Datastore.FileManagement privilege. Modern VMware environments are not identified as affected in the supplied source bundle. Treat this as a legacy infrastructure hygiene issue with elevated importance if ESX/ESXi 3.5 still exists. The main business risk is privilege escalation inside virtualization management, but available evidence does not support emergency active-exploitation handling. Mitigation focus: Apply or verify VMware ESXi patch ESXe350-200810401-O-UG where applicable.; Apply or verify VMware ESX patch ESX350-200810201-UG where applicable.; Remove Datastore.FileManagement privilege from accounts that do not require it..

Prepared

Jun 28, 2026, 11:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.