VMware known exploited vulnerabilities
Every VMware CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 26 in all, 0 added in the last 12 months.
- CVE-2025-22225VMware ESXi contains an arbitrary write vulnerability.VMware ESXi · VMware Cloud Foundation +2
- CVE-2024-37085VMware ESXi contains an authentication bypass vulnerability.VMware ESXi · VMware Cloud Foundation
- CVE-2022-22954VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.VMware Workspace ONE Access and Identity Manager
- CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network accessVMware vRealize Operations
- CVE-2021-22005The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-21985The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plVMware vCenter Server and VMware Cloud Foundation
- CVE-2021-21972The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.VMware vCenter Server · VMware Cloud Foundation
- CVE-2020-3992OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a VMware ESXi
- CVE-2019-5544OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.ESXi and Horizon DaaS
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many VMware vulnerabilities are in CISA KEV?
26 VMware vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2025-22226 (VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability), added 2025-03-04.
Which VMware products are in CISA KEV?
14 products, including ESXi, Workstation, and Fusion, ESXi, ESXi and Workstation. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are VMware KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 9 of the 26 VMware entries.