Read the docs

VMware

Records1182All Threatist records
Exploited (KEV)41In CISA KEV
CVSS critical188CVSS 9.0–10.0
CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV
TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability Priority HIGH 71KEV 2026-10-28TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-08-18TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery Priority CRITICAL 92KEV 2026-03-09TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability Priority CRITICAL 94KEV 2026-03-03TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability Priority CRITICAL 100KEV 2026-01-23TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability Priority CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records
Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

1182 records

TI-2026-42442 CVE-2026-59310 · GHSA-v2gp-49gj-2c9f

vCenter directory-traversal vulnerability

Priority CRITICAL 100KEV

VMware vCenter contains a directory traversal vulnerability in the Syslog server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61668 Published 2026-07-30 Fixed in 9.1.0.0300, 9.0.2.0100 +1 CWE-22
TI-2024-26040 CVE-2024-38813 · GHSA-66vj-hxh5-x3jh

Privilege escalation in VMware vCenter Server

Priority CRITICAL 100KEV

The vCenter Server contains a privilege escalation vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17355 Published 2024-09-17 Fixed in 8.0 U3b, 7.0 U3s CWE-250
TI-2024-26039 CVE-2024-38812 · GHSA-72q3-gvh6-6m6w

Heap-overflow in VMware vCenter Server

Priority CRITICAL 100KEV

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.54571 Published 2024-09-17 Fixed in 8.0 U3b, 7.0 U3s CWE-122
TI-2024-24610 CVE-2024-37079 · GHSA-qqfg-j9g4-4mfh

Out-of-bounds write in VMware vCenter Server

Priority CRITICAL 100KEV

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.22377 Published 2024-06-18 Fixed in 8.0 U2d, 8.0 U1e +1 CWE-787
TI-2023-16914 CVE-2023-34048 · GHSA-87j2-5g9j-7jmv

VMware vCenter Server Out-of-Bounds Write Vulnerability

Priority CRITICAL 100KEV

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99234 Published 2023-10-25 Fixed in 8.0U2, 7.0U3o CWE-787
TI-2023-07303 CVE-2023-20887 · GHSA-8vx8-r5j3-f2vf

Command injection in Aria Operations for Networks

Priority CRITICAL 100KEV

Aria Operations for Networks contains a command injection vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.98281 Published 2023-06-07 No fix listed CWE-77
TI-2022-07142 CVE-2022-22965 · GHSA-36p3-wjmg-h94x

Code injection in Spring Framework

Priority CRITICAL 100KEV

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99638 Published 2022-04-01 Partial fix · 5.2.20.RELEASE, 5.3.18 +2 CWE-94
TI-2022-07140 CVE-2022-22963 · GHSA-6v73-fgf6-w5j7

Code injection in Spring Cloud Function

Priority CRITICAL 100KEV

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in rem…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99938 Published 2022-04-01 Fixed in 3.2.3, 3.1.7 CWE-94
TI-2022-07131 CVE-2022-22954 · GHSA-q7xc-35g4-g566

Code injection in VMware Workspace ONE Access and Identity Manager

Priority CRITICAL 100KEV

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99998 Published 2022-04-11 No fix listed CWE-94
TI-2022-07125 CVE-2022-22947 · GHSA-3gx9-37ww-9qw6

Code injection in Spring Cloud Gateway

Priority CRITICAL 100KEV

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.98253 Published 2022-03-03 Fixed in 3.0.7, 3.1.1 CWE-94
TI-2021-05029 CVE-2021-21985 · GHSA-rg6m-2r9v-c5fj

Improper input validation in VMware vCenter Server and VMware Cloud Foundation

Priority CRITICAL 100KEV

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2021-05-26 No fix listed CWE-20
TI-2021-05020 CVE-2021-21975 · GHSA-px27-325w-m34c

Server-side request forgery in VMware vRealize Operations

Priority CRITICAL 100KEV

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forger…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.78001 Published 2021-03-31 No fix listed CWE-918
TI-2021-05017 CVE-2021-21972 · GHSA-c9cr-34rr-8gpr

Path traversal in VMware vCenter Server

Priority CRITICAL 100KEV

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99865 Published 2021-02-24 Fixed in 4.2, 3.10.1.2 CWE-22
TI-2020-03488 CVE-2020-3992 · GHSA-58ff-49fr-3jwf

Use after free in VMware ESXi

Priority CRITICAL 100KEV

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83015 Published 2020-10-20 No fix listed CWE-416
TI-2020-03450 CVE-2020-3952 · GHSA-rqpw-v3g2-qccx

Missing authentication in VMware vCenter Server

Priority CRITICAL 100KEV

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.90384 Published 2020-04-10 No fix listed CWE-306
TI-2019-03949 CVE-2019-5544 · GHSA-4734-5452-r5fh

Out-of-bounds write in ESXi and Horizon DaaS

Priority CRITICAL 100KEV

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.98129 Published 2019-12-06 Fixed CWE-787
TI-2018-01178 CVE-2018-1273 · GHSA-4fq3-mr56-cg6r

Code injection in Spring Framework

Priority CRITICAL 100KEV

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96956 Published 2018-04-11 Partial fix · 1.13.11, 2.0.6 CWE-94
TI-2014-05975 CVE-2014-7169 · GHSA-f7j6-xrjp-vffg

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed…

Priority CRITICAL 100KEV

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown oth…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9994 Published 2014-09-25 Fixed CWE-78
TI-2014-05157 CVE-2014-6271 · GHSA-6hfc-grwp-2p9c

GNU Bash through 4.3 processes trailing strings after function definitions in the values…

Priority CRITICAL 100KEV

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2014-09-24 Fixed CWE-78
TI-2025-16135 CVE-2025-22224 · GHSA-j652-46fv-w96g

Time-of-check time-of-use race condition in VMware ESXi

Priority CRITICAL 99KEV

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.

CVSS 3.1CRITICAL 9.3 Local No auth No interaction EPSS 0.01561 Published 2025-03-04 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300 +2 CWE-367
TI-2025-16136 CVE-2025-22225 · GHSA-2cxw-wgvv-24jj

Out-of-bounds write in VMware ESXi

Priority CRITICAL 95KEV

VMware ESXi contains an arbitrary write vulnerability.

CVSS 3.1HIGH 8.2 Local High privileges No interaction EPSS 0.01016 Published 2025-03-04 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300 +1 CWE-123
Load more
Open these records in search →