A remote code execution vulnerability in a vCenter Server plugin exists in the vSphere Client (HTML5). All default install include the affected vCenter Server plugin for vRealize Operations (vROps).
Updates are available to remediate these vulnerabilities in affected VMware products.