CVE-2015-2342: VMware vCenter JMX RMI MBean registration allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityThe flaw allows unauthenticated remote code execution on a central management server, and the very high EPSS score signals strong likelihood of exploitation.

What it is

The JMX RMI service in VMware vCenter Server does not restrict registration of MBeans, letting a remote attacker register a malicious MBean and execute arbitrary code over the RMI protocol. Because vCenter is a central management component, compromise can expose the virtual infrastructure it controls. The record does not state whether authentication is required beyond the network vector.

Impact

An unauthenticated network attacker can execute arbitrary code with the privileges of the vCenter JMX service, potentially taking control of the management server and the virtual environment it administers.

Attack surface

Reachable over the network via the RMI protocol on the JMX service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are needed. The description does not specify the exact port or whether the service is exposed by default.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.89048, 99.77th percentile), indicating substantial predicted exploitation activity. Reference tags include only Patch and Vendor Advisory, with no public exploit tag.

What to do

• Apply the VMware vCenter Server updates referenced in VMSA-2015-0007 (5.0 u3e, 5.1 u3b, 5.5 u3, 6.0 u1 or later).
• Restrict network access to the JMX RMI service so only trusted management hosts can reach it.
• Disable or firewall the JMX RMI interface if it is not required for operations.
• Monitor vCenter and its host for unexpected MBean registrations or process execution.
• Review vCenter for signs of compromise and rotate credentials for accounts with management access.

Detection

• Monitor network traffic to the vCenter JMX RMI port for unexpected external connections.
• Audit vCenter logs for MBean registration events or JMX service errors.
• Alert on new or unusual child processes spawned by the vCenter JMX service.
• Track authentication and configuration changes on vCenter hosts for anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.