VMware
VMware vCenter Server 7.0
VMware vCenter Server 7.0
The VMware vCenter Server 7.0 reached end of service life on Oct 2, 2025. Third-party maintenance keeps it supported — 24/7 engineering support and same-day replacement parts — at 40-70% below OEM renewal pricing.
End of Service LifeEOSL Date: Oct 2, 2025
Specifications
- product
- vcenter
- release
- 7.0
- product Label
- VMware vCenter Server
- release Label
- 7.0
- codename
- lts
- latest Version
- 7.0 U3w
- release Date
- 2020-04-02
- maintained
- source Url
- https://endoflife.date/vcenter
Lifecycle Dates
- End of Service Life
- Oct 2, 2025
- Last OEM Support
- Oct 2, 2025
OEM vs. 3rd Party Support
See how 3rd party maintenance compares to traditional OEM support for your VMware vCenter Server 7.0. Get the same level of service at a fraction of the cost.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| 24/7/365 Support | ||
| Same-Day Parts Replacement | Limited | |
| Mixed-Vendor Support | ||
| Flexible Contract Terms | Annual Only | Month-to-Month Available |
| Asset Lifecycle Extension | ||
| OEM-Trained Engineers |
Why Choose 3rd Party Support for VMware vCenter Server 7.0?
Save 40-70%
Dramatically reduce your maintenance costs while maintaining the same level of support coverage.
Extend Asset Life
Continue using your VMware vCenter Server 7.0 well beyond the OEM end-of-life date.
24/7 Expert Support
OEM-trained engineers available around the clock with same-day parts replacement.
VMware vCenter Server 7.0 Support: Frequently Asked Questions
Is the VMware vCenter Server 7.0 still supported?
VMware ended support for the VMware vCenter Server 7.0 on Oct 2, 2025. Third-party maintenance remains available and keeps the VMware vCenter Server 7.0 supported with 24/7 engineering support and same-day replacement parts.
When is the VMware vCenter Server 7.0 end of service life (EOSL) date?
VMware lists the end of service life for the VMware vCenter Server 7.0 as Oct 2, 2025.
Can I keep using the VMware vCenter Server 7.0 after its EOSL date?
Yes. EOSL means VMware stops selling support contracts and issuing updates — the equipment itself keeps working. Third-party maintenance provides engineering support and replacement parts for as long as you choose to run it.
How much does third-party support for the VMware vCenter Server 7.0 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting VMware vCenter Server 7.0
45 published CVEs affect the VMware vCenter Server 7.0, including 30 rated critical or high severity. VMware no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59310 | CRITICAL | 9.8 | Jul 30, 2026 | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. |
| CVE-2026-59309 | CRITICAL | 9.8 | Jul 30, 2026 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. |
| CVE-2024-38812 | CRITICAL | 9.8 | Sep 17, 2024 | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. |
| CVE-2024-37080 | CRITICAL | 9.8 | Jun 18, 2024 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. |
| CVE-2024-37079 | CRITICAL | 9.8 | Jun 18, 2024 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. |
| CVE-2023-34048 | CRITICAL | 9.8 | Oct 25, 2023 | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. |
| CVE-2021-22049 | CRITICAL | 9.8 | Nov 24, 2021 | The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. |
| CVE-2021-22005 | CRITICAL | 9.8 | Sep 23, 2021 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. |
| CVE-2021-21986 | CRITICAL | 9.8 | May 26, 2021 | The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication. |
| CVE-2021-21985 | CRITICAL | 9.8 | May 26, 2021 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. |
| CVE-2021-21972 | CRITICAL | 9.8 | Feb 24, 2021 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). |
| CVE-2021-22048 | HIGH | 8.8 | Nov 10, 2021 | The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group. |
| CVE-2023-20895 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication. |
| CVE-2023-20894 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption. |
| CVE-2023-20893 | HIGH | 8.1 | Jun 22, 2023 | The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. |
| CVE-2023-20892 | HIGH | 8.1 | Jun 22, 2023 | The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server. |
| CVE-2024-37081 | HIGH | 7.8 | Jun 18, 2024 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance. |
| CVE-2021-22015 | HIGH | 7.8 | Sep 23, 2021 | The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. |
| CVE-2021-21991 | HIGH | 7.8 | Sep 22, 2021 | The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash). |
| CVE-2024-38813 | HIGH | 7.5 | Sep 17, 2024 | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet. |
Showing the 20 most severe of 45 known CVEs.
Get Third Party SupportRelated VMware Products
All VMware products →VMware vCenter Server 7.0
Save 40-70% vs OEM