Is CVE-2018-6961 actively exploited?

CVE-2018-6961 has no public evidence of in-the-wild exploitation as of 2025-10-30.

What is the CVSS score for CVE-2018-6961?

CVE-2018-6961 has a CVSS score of 8.1 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2018-6961?

Patch guidance is available from vmware security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2018-6961.

Which products are affected by CVE-2018-6961?

1 product: vmware nsx sd-wan by velocloud.

Fix CVE-2018-6961 - HIGH vmware nsx sd-wan by velocloud

Description

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: network
Complexity: high
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-78 · OS Command Injection CWE-78 · OS Command Injection

Metadata

Primary Vendor: VMWARE
Published: 6/11/2018
Last Modified: 10/30/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

CVE-2018-6961

Description

CVSS Metrics

Metadata

Affected Products

Remediation Guidance

Executive Summary