VMware
VMware vCenter Server 6.5
VMware vCenter Server 6.5
The VMware vCenter Server 6.5 reached end of service life on Oct 15, 2022. Third-party maintenance keeps it supported — 24/7 engineering support and same-day replacement parts — at 40-70% below OEM renewal pricing.
End of Service LifeEOSL Date: Oct 15, 2022
Specifications
- product
- vcenter
- release
- 6.5
- product Label
- VMware vCenter Server
- release Label
- 6.5
- codename
- lts
- latest Version
- 6.5 U3w
- release Date
- 2016-11-15
- maintained
- source Url
- https://endoflife.date/vcenter
Lifecycle Dates
- End of Service Life
- Oct 15, 2022
- Last OEM Support
- Oct 15, 2022
OEM vs. 3rd Party Support
See how 3rd party maintenance compares to traditional OEM support for your VMware vCenter Server 6.5. Get the same level of service at a fraction of the cost.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| 24/7/365 Support | ||
| Same-Day Parts Replacement | Limited | |
| Mixed-Vendor Support | ||
| Flexible Contract Terms | Annual Only | Month-to-Month Available |
| Asset Lifecycle Extension | ||
| OEM-Trained Engineers |
Why Choose 3rd Party Support for VMware vCenter Server 6.5?
Save 40-70%
Dramatically reduce your maintenance costs while maintaining the same level of support coverage.
Extend Asset Life
Continue using your VMware vCenter Server 6.5 well beyond the OEM end-of-life date.
24/7 Expert Support
OEM-trained engineers available around the clock with same-day parts replacement.
VMware vCenter Server 6.5 Support: Frequently Asked Questions
Is the VMware vCenter Server 6.5 still supported?
VMware ended support for the VMware vCenter Server 6.5 on Oct 15, 2022. Third-party maintenance remains available and keeps the VMware vCenter Server 6.5 supported with 24/7 engineering support and same-day replacement parts.
When is the VMware vCenter Server 6.5 end of service life (EOSL) date?
VMware lists the end of service life for the VMware vCenter Server 6.5 as Oct 15, 2022.
Can I keep using the VMware vCenter Server 6.5 after its EOSL date?
Yes. EOSL means VMware stops selling support contracts and issuing updates — the equipment itself keeps working. Third-party maintenance provides engineering support and replacement parts for as long as you choose to run it.
How much does third-party support for the VMware vCenter Server 6.5 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting VMware vCenter Server 6.5
42 published CVEs affect the VMware vCenter Server 6.5, including 28 rated critical or high severity. VMware no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59310 | CRITICAL | 9.8 | Jul 30, 2026 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. |
| CVE-2026-59309 | CRITICAL | 9.8 | Jul 30, 2026 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. |
| CVE-2021-22049 | CRITICAL | 9.8 | Nov 24, 2021 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. |
| CVE-2021-22005 | CRITICAL | 9.8 | Sep 23, 2021 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. |
| CVE-2021-21986 | CRITICAL | 9.8 | May 26, 2021 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication. |
| CVE-2021-21985 | CRITICAL | 9.8 | May 26, 2021 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. |
| CVE-2021-21972 | CRITICAL | 9.8 | Feb 24, 2021 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). |
| CVE-2017-4923 | CRITICAL | 9.8 | Aug 1, 2017 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature. |
| CVE-2022-31680 | CRITICAL | 9.1 | Oct 7, 2022 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server. |
| CVE-2017-4919 | CRITICAL | 9.0 | Jul 28, 2017 | VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate. |
| CVE-2021-22048 | HIGH | 8.8 | Nov 10, 2021 | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group. |
| CVE-2017-4921 | HIGH | 8.8 | Aug 1, 2017 | VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation. |
| CVE-2023-20895 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication. |
| CVE-2023-20894 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption. |
| CVE-2023-20893 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. |
| CVE-2023-20892 | HIGH | 8.1 | Jun 22, 2023 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server. |
| CVE-2021-22015 | HIGH | 7.8 | Sep 23, 2021 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. |
| CVE-2021-21991 | HIGH | 7.8 | Sep 22, 2021 | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash). |
| CVE-2017-4943 | HIGH | 7.8 | Dec 20, 2017 | VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitation of this issue could result in a low privileged user gaining root level privileges over the appliance base OS. |
| CVE-2019-5534 | HIGH | 7.7 | Sep 18, 2019 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine). |
Showing the 20 most severe of 42 known CVEs.
Get Third Party SupportRelated VMware Products
All VMware products →VMware vCenter Server 6.5
Save 40-70% vs OEM