VMware
VMware vCenter Server 5.5
VMware vCenter Server 5.5
The VMware vCenter Server 5.5 reached end of service life on Sep 19, 2018. Third-party maintenance keeps it supported — 24/7 engineering support and same-day replacement parts — at 40-70% below OEM renewal pricing.
End of Service LifeEOSL Date: Sep 19, 2018
Specifications
- product
- vcenter
- release
- 5.5
- product Label
- VMware vCenter Server
- release Label
- 5.5
- codename
- lts
- latest Version
- 5.5 U3k
- release Date
- 2013-09-19
- maintained
- source Url
- https://endoflife.date/vcenter
Lifecycle Dates
- End of Service Life
- Sep 19, 2018
- Last OEM Support
- Sep 19, 2018
OEM vs. 3rd Party Support
See how 3rd party maintenance compares to traditional OEM support for your VMware vCenter Server 5.5. Get the same level of service at a fraction of the cost.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| 24/7/365 Support | ||
| Same-Day Parts Replacement | Limited | |
| Mixed-Vendor Support | ||
| Flexible Contract Terms | Annual Only | Month-to-Month Available |
| Asset Lifecycle Extension | ||
| OEM-Trained Engineers |
Why Choose 3rd Party Support for VMware vCenter Server 5.5?
Save 40-70%
Dramatically reduce your maintenance costs while maintaining the same level of support coverage.
Extend Asset Life
Continue using your VMware vCenter Server 5.5 well beyond the OEM end-of-life date.
24/7 Expert Support
OEM-trained engineers available around the clock with same-day parts replacement.
VMware vCenter Server 5.5 Support: Frequently Asked Questions
Is the VMware vCenter Server 5.5 still supported?
VMware ended support for the VMware vCenter Server 5.5 on Sep 19, 2018. Third-party maintenance remains available and keeps the VMware vCenter Server 5.5 supported with 24/7 engineering support and same-day replacement parts.
When is the VMware vCenter Server 5.5 end of service life (EOSL) date?
VMware lists the end of service life for the VMware vCenter Server 5.5 as Sep 19, 2018.
Can I keep using the VMware vCenter Server 5.5 after its EOSL date?
Yes. EOSL means VMware stops selling support contracts and issuing updates — the equipment itself keeps working. Third-party maintenance provides engineering support and replacement parts for as long as you choose to run it.
How much does third-party support for the VMware vCenter Server 5.5 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting VMware vCenter Server 5.5
21 published CVEs affect the VMware vCenter Server 5.5, including 13 rated critical or high severity. VMware no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59310 | CRITICAL | 9.8 | Jul 30, 2026 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. |
| CVE-2026-59309 | CRITICAL | 9.8 | Jul 30, 2026 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. |
| CVE-2023-34048 | CRITICAL | 9.8 | Oct 25, 2023 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. |
| CVE-2022-31680 | CRITICAL | 9.1 | Oct 7, 2022 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server. |
| CVE-2017-4919 | CRITICAL | 9.0 | Jul 28, 2017 | VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate. |
| CVE-2015-2342 | HIGH | 10.0 | Oct 12, 2015 | The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. |
| CVE-2023-20895 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication. |
| CVE-2023-20894 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption. |
| CVE-2023-20893 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. |
| CVE-2023-20892 | HIGH | 8.1 | Jun 22, 2023 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server. |
| CVE-2016-7459 | HIGH | 7.7 | Dec 29, 2016 | VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2016-2076 | HIGH | 7.6 | Apr 15, 2016 | Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site. |
| CVE-2017-4928 | HIGH | 7.5 | Nov 17, 2017 | The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers towards internal services leading to information disclosure. |
| CVE-2016-5331 | MEDIUM | 6.1 | Aug 8, 2016 | CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. |
| CVE-2015-6931 | MEDIUM | 6.1 | Jul 3, 2016 | Cross-site scripting (XSS) vulnerability in the vSphere Web Client in VMware vCenter Server 5.0 before U3g, 5.1 before U3d, and 5.5 before U2d allows remote attackers to inject arbitrary web script or HTML via a crafted URL. |
| CVE-2016-2078 | MEDIUM | 6.1 | Jun 8, 2016 | Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter. |
| CVE-2023-20896 | MEDIUM | 5.9 | Jun 22, 2023 | The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd). |
| CVE-2015-6932 | MEDIUM | 5.8 | Sep 18, 2015 | VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2015-1047 | MEDIUM | 5.0 | Oct 12, 2015 | vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message. |
| CVE-2023-34056 | MEDIUM | 4.3 | Oct 25, 2023 | vCenter Server contains a partial information disclosure vulnerability. A malicious actor with non-administrative privileges to vCenter Server may leverage this issue to access unauthorized data. |
Showing the 20 most severe of 21 known CVEs.
Get Third Party SupportRelated VMware Products
All VMware products →VMware vCenter Server 5.5
Save 40-70% vs OEM