CVE-2017-4914: VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue.

Security readout for executives and security teams

This issue affects older VMware vSphere Data Protection appliances. A remote attacker may be able to abuse unsafe deserialization to run commands on the backup appliance. That can threaten backup integrity and recovery operations. The supplied sources do not provide CVSS scoring, named fixed builds, or evidence of active exploitation. Exposure is likely limited to environments still running VMware VDP 6.1.x, 6.0.x, 5.8.x, or 5.5.x. Risk is higher where the appliance is reachable from broad internal networks, untrusted segments, or administrative networks shared with non-admin users. Prioritize this where VDP remains in production or protects critical recovery data. Remote command execution against a backup appliance can undermine recovery assurance. Absence from KEV lowers evidence of current exploitation, but public exploit availability and legacy product exposure justify prompt remediation planning. Mitigation focus: Inventory VMware VDP appliances and identify exact deployed versions.; Review VMware advisory VMSA-2017-0010 for supported fixes or vendor-directed actions.; Remove or retire unsupported VDP appliances where feasible..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.