VMware known exploited vulnerabilities
Every VMware CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 26 in all, 0 added in the last 12 months.
- CVE-2025-22226VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.ESXi · VMware Workstation +4
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability.VMware ESXi · VMware Cloud Foundation +2
- CVE-2025-22224VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.VMware ESXi · VMware Workstation +3
- CVE-2024-38813Privilege escalation vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2024-38812Heap-overflow vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2024-37085VMware ESXi contains an authentication bypass vulnerability.VMware ESXi · VMware Cloud Foundation
- CVE-2022-22948The vCenter Server contains an information disclosure vulnerability due to improper permission of files.VMware vCenter Server and VMware Cloud Foundation
- CVE-2023-34048VMware vCenter Server Out-of-Bounds Write VulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2023-20867VMware Tools Authentication Bypass VulnerabilityVMware Tools
- CVE-2023-20887Aria Operations for Networks contains a command injection vulnerability.Aria Operations for Networks
- CVE-2022-22947In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatSpring Cloud Gateway · org.springframework.cloud:spring-clo…
- CVE-2022-22960VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissioVMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2022-22954VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.VMware Workspace ONE Access and Identity Manager
- CVE-2022-22965A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.Spring Framework · org.springframework:spring-beans +4
- CVE-2018-6961VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.VMware NSX SD-WAN by VeloCloud
- CVE-2021-21973The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter ServVMware vCenter Server · VMware Cloud Foundation
- CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network accessVMware vRealize Operations
- CVE-2021-22017Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22005The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-21985The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plVMware vCenter Server and VMware Cloud Foundation
- CVE-2021-21972The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.VMware vCenter Server · VMware Cloud Foundation
- CVE-2020-4006VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerabiliVMware Workspace One Access (Access), VMware Workspace One…
- CVE-2020-3992OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a VMware ESXi
- CVE-2020-3952Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller…VMware vCenter Server
- CVE-2020-3950VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior bVMware Fusion, VMware Remote Console for Mac and Horizon Cl…
- CVE-2019-5544OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.ESXi and Horizon DaaS
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many VMware vulnerabilities are in CISA KEV?
26 VMware vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2025-22226 (VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability), added 2025-03-04.
Which VMware products are in CISA KEV?
14 products, including ESXi, Workstation, and Fusion, ESXi, ESXi and Workstation. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are VMware KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 9 of the 26 VMware entries.