VMware Vulnerabilities
VMware, now part of Broadcom, develops the vSphere virtualization platform, whose ESXi hypervisor and vCenter Server management appliance account for most VMware entries in KEV. The database tracks 33 VMware CVE records. CISA lists 33 of them as exploited in the wild, most recently on 2026-08-18. The most affected products are vCenter Server, ESXi, Aria Operations for Networks.
Recently Exploited VMware CVEs
vCenter directory-traversal vulnerability
VMware Aria Operations command injection vulnerability
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Affected Products
21 products| Product | CVEs | KEV | Latest |
|---|---|---|---|
| vCenter Server | 9 | 9 | 2024-11-20 |
| ESXi | 3 | 3 | 2025-03-04 |
| Multiple Products | 3 | 3 | 2022-04-15 |
| Aria Operations for Networks | 1 | 1 | 2023-06-22 |
| ESXi and Workstation | 1 | 1 | 2025-03-04 |
| ESXi, Workstation, and Fusion | 1 | 1 | 2025-03-04 |
| SD-WAN Edge | 1 | 1 | 2022-03-25 |
| Spring Cloud | 1 | 1 | 2022-08-25 |
| Spring Cloud Configuration (Config) Server | 1 | 1 | 2022-03-25 |
| Spring Cloud Gateway | 1 | 1 | 2022-05-16 |
| Spring Data Commons | 1 | 1 | 2022-03-25 |
| Spring Framework | 1 | 1 | 2022-04-04 |
| Tools | 1 | 1 | 2023-06-23 |
| vCenter Server and Cloud Foundation | 1 | 1 | 2022-03-07 |
| VMware Aria Operations | 1 | 1 | 2026-03-03 |
| VMware Aria Operations and VMware Tools | 1 | 1 | 2025-10-30 |
| VMware ESXi and Horizon DaaS | 1 | 1 | 2021-11-03 |
| VMware vCenter | 1 | 1 | 2026-08-18 |
| VMware vCenter Server | 1 | 1 | 2026-01-23 |
| vRealize Operations Manager API | 1 | 1 | 2022-01-18 |
| Workspace ONE Access and Identity Manager | 1 | 1 | 2022-04-14 |
All VMware CVEs
33 records| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-59310 | vCenter directory-traversal vulnerability | VMware | 9.8 | 2.6% | KEV | 2026-07-30 |
| CVE-2026-22719 | VMware Aria Operations command injection vulnerability | VMware | 8.1 | 17.7% | KEV | 2026-02-25 |
| CVE-2024-37079 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability | - | 9.8 | 22.4% | KEV | 2024-06-18 |
| CVE-2025-41244 | VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246) | VMware | 7.8 | 8.4% | KEV | 2025-09-29 |
| CVE-2025-22226 | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | - | 7.1 | 1.8% | KEV | 2025-03-04 |
| CVE-2025-22224 | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | VMware | 9.3 | 1.6% | KEV | 2025-03-04 |
| CVE-2025-22225 | VMware ESXi Arbitrary Write Vulnerability | - | 8.2 | 1.0% | KEV | 2025-03-04 |
| CVE-2024-38812 | Heap-overflow vulnerability | - | 9.8 | 54.6% | KEV | 2024-09-17 |
| CVE-2024-38813 | Privilege escalation vulnerability | - | 7.5 | 17.4% | KEV | 2024-09-17 |
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | - | 6.8 | 26.8% | KEV | 2024-06-25 |
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | - | 6.5 | 13.3% | KEV | 2022-03-29 |
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability | VMware | 9.8 | 99.4% | KEV | 2023-10-25 |
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | VMware | 3.9 | 13.5% | KEV | 2023-06-13 |
| CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability | - | 9.8 | 98.3% | KEV | 2023-06-07 |
| CVE-2022-22963 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | - | 9.8 | 99.9% | KEV | 2022-04-01 |
| CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability | - | 10.0 | 98.3% | KEV | 2022-03-03 |
| CVE-2022-22960 | VMware Multiple Products Privilege Escalation Vulnerability | - | 7.8 | 35.5% | KEV | 2022-04-13 |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | - | 9.8 | 100.0% | KEV | 2022-04-11 |
| CVE-2022-22965 | Spring Framework JDK 9+ Remote Code Execution Vulnerability | - | 9.8 | 99.6% | KEV | 2022-04-01 |
| CVE-2018-1273 | VMware Tanzu Spring Data Commons Property Binder Vulnerability | Spring by Pivotal | 9.8 | 97.0% | KEV | 2018-04-11 |
| CVE-2020-5410 | Directory Traversal with spring-cloud-config-server | Spring by VMware | 7.5 | 95.6% | KEV | 2020-06-02 |
| CVE-2018-6961 | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | VMware | 8.1 | 86.3% | KEV | 2018-06-11 |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | - | 5.3 | 88.0% | KEV | 2021-02-24 |
| CVE-2021-21975 | VMware Server Side Request Forgery in vRealize Operations Manager API | - | 9.8 | 78.0% | KEV | 2021-03-31 |
| CVE-2021-22017 | VMware vCenter Server Improper Access Control | - | 5.3 | 49.2% | KEV | 2021-09-23 |
| CVE-2021-21985 | VMware vCenter Server Improper Input Validation Vulnerability | - | 9.8 | 100.0% | KEV | 2021-05-26 |
| CVE-2021-22005 | VMware vCenter Server File Upload Vulnerability | - | 9.8 | 100.0% | KEV | 2021-09-23 |
| CVE-2021-21972 | VMware vCenter Server Remote Code Execution Vulnerability | - | 9.8 | 99.9% | KEV | 2021-02-24 |
| CVE-2019-5544 | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | - | 9.8 | 97.3% | KEV | 2019-12-06 |
| CVE-2020-3952 | VMware vCenter Server Information Disclosure Vulnerability | - | 9.8 | 90.4% | KEV | 2020-04-10 |
| CVE-2020-3992 | VMware ESXi OpenSLP Use-After-Free Vulnerability | - | 9.8 | 83.0% | KEV | 2020-10-20 |
| CVE-2020-4006 | Multiple VMware Products Command Injection Vulnerability | - | 9.1 | 17.3% | KEV | 2020-11-23 |
| CVE-2020-3950 | VMware Multiple Products Privilege Escalation Vulnerability | - | 7.8 | 7.3% | KEV | 2020-03-17 |
Frequently Asked Questions
How many VMware vulnerabilities are actively exploited?→
33 VMware CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-09. The latest was added on 2026-08-18.
Which VMware vulnerabilities are used in ransomware attacks?→
CISA marks 11 VMware KEV entries as known to be used in ransomware campaigns, including CVE-2026-59310, CVE-2025-22225, CVE-2024-37085, CVE-2022-22954, CVE-2018-1273.
Which VMware products have the most exploited vulnerabilities?→
- +vCenter Server: 9 CVEs (9 in KEV)
- +ESXi: 3 CVEs (3 in KEV)
- +Multiple Products: 3 CVEs (3 in KEV)
- +Aria Operations for Networks: 1 CVE (1 in KEV)
- +ESXi and Workstation: 1 CVE (1 in KEV)
Where does VMware publish security advisories?→
VMware publishes security advisories at https://support.broadcom.com/web/ecx/security-advisory. Check the vendor advisory for fixed versions and workarounds before applying updates.
Sources
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Vendor and product names for exploited CVEs follow the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not affiliated with or endorsed by VMware, MITRE, CISA, or FIRST.