VMWare just posted this advisory:
vCenter Server 6.7 (embedded or external PSC) prior to 6.7u3f is affected by CVE-2020-3952. Only if it was upgraded from previous versions 6.0 or 6.5. Clean installations of vCenter Server 6.7 (embedded or external PSC) are not affected.
KB to determine if your vCenter is affected:
Upgrade to 6.7U3f or 7.0.
My blog article on performing in place upgrade on existing 6.7 vCenter to 6.7 U3f