CVE-2016-7460: The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automati...

Security readout for executives and security teams

This VMware issue affects Single Sign-On in older vCenter Server and vRealize Automation releases. A remote attacker could abuse XML processing to read files from the server or disrupt service. Because SSO supports core administrative access, exposure on management networks should be treated seriously even though no active exploitation is cited. Organizations are exposed if they still operate the affected VMware vCenter Server or vRealize Automation versions, especially where SSO or management services are reachable by untrusted users or broad internal networks. Prioritize remediation for any still-running affected VMware management stack. The issue targets identity-adjacent management services and can expose local files or disrupt operations, but the provided evidence does not show known active exploitation. Mitigation focus: Upgrade vCenter Server 5.5 to U3e or later.; Upgrade vCenter Server 6.0 to U2a or later.; Upgrade vRealize Automation 6.x to 6.2.5 or later..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.