VMware

Records1182All Threatist records

Exploited (KEV)41In CISA KEV

CVSS critical188CVSS 9.0–10.0

CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV

TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability HIGH 71KEV 2026-10-28 TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability CRITICAL 100KEV 2026-08-18 TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery CRITICAL 92KEV 2026-03-09 TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability CRITICAL 94KEV 2026-03-03 TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability CRITICAL 100KEV 2026-01-23 TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

28 records in Identity Manager · all components

TI-2022-07131 CVE-2022-22954 · GHSA-q7xc-35g4-g566

Code injection in VMware Workspace ONE Access and Identity Manager

CRITICAL 100KEV

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99998 Published 2022-04-11 No fix listed CWE-94

TI-2020-03502 CVE-2020-4006 · GHSA-hj5r-2q87-qf8g

OS command injection in VMware Workspace One Access , VMware Workspace One Access…

CRITICAL 98KEV

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.17302 Published 2020-11-23 No fix listed CWE-78

TI-2022-07137 CVE-2022-22960 · GHSA-8r7c-vjv4-wp6x

Incorrect permission assignment in VMware Workspace ONE Access, Identity Manager and…

CRITICAL 93KEV

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.35519 Published 2022-04-13 No fix listed CWE-732

TI-2022-07149 CVE-2022-22972 · GHSA-ffjg-mw44-7fw8

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an…

HIGH 75

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.56305 Published 2022-05-20 No fix listed

TI-2022-07133 CVE-2022-22956 · GHSA-54hw-pp59-j3rc

Improper authentication in VMware Workspace ONE Access

HIGH 73

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.49533 Published 2022-04-13 No fix listed CWE-287

TI-2022-13575 CVE-2022-31656 · GHSA-hvqf-whpm-54wr

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an…

MEDIUM 63

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24675 Published 2022-08-05 No fix listed

TI-2022-07132 CVE-2022-22955 · GHSA-vv47-c6mc-7w69

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955…

MEDIUM 53

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0782 Published 2022-04-13 No fix listed

TI-2022-07134 CVE-2022-22957 · GHSA-cqx6-4jgp-26m2

Deserialization of untrusted data in VMware Workspace ONE Access, Identity Manager and…

MEDIUM 52

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.23307 Published 2022-04-13 No fix listed CWE-502

TI-2022-13576 CVE-2022-31657 · GHSA-vqqr-hhw5-5mrg

Open redirect in VMware Workspace ONE Access, Identity Manager and vRealize Automation

MEDIUM 45

VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01341 Published 2022-08-05 No fix listed CWE-601

TI-2021-05046 CVE-2021-22002 · GHSA-35g3-x9xw-f42c

Improper authentication in VMware Workspace ONE Access, Identity Manager and vRealize…

MEDIUM 44

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01207 Published 2021-08-31 No fix listed CWE-287

TI-2022-13618 CVE-2022-31700 · GHSA-5cxh-9g8r-jph6

VMware Workspace ONE Access and Identity Manager contain an authenticated remote code…

MEDIUM 42

VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01169 Published 2022-12-14 No fix listed

TI-2022-07150 CVE-2022-22973 · GHSA-4hvh-jpvg-gwfm

VMware Workspace ONE Access and Identity Manager contain a privilege escalation…

LOW 39

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.02354 Published 2022-05-20 No fix listed

TI-2022-13578 CVE-2022-31659 · GHSA-xpqf-h5q4-9r99

SQL injection in VMware Workspace ONE Access, Identity Manager and vRealize Automation

LOW 37

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02999 Published 2022-08-05 No fix listed CWE-89

TI-2022-07135 CVE-2022-22958 · GHSA-h783-2f78-cqf2

Deserialization of untrusted data in VMware Workspace ONE Access, Identity Manager and…

LOW 37

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03066 Published 2022-04-13 No fix listed CWE-502

TI-2022-13584 CVE-2022-31665 · GHSA-7rr3-rm24-h4rp

Injection in VMware Workspace ONE Access, Identity Manager and vRealize Automation

LOW 36

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02518 Published 2022-08-05 No fix listed CWE-74

TI-2022-13579 CVE-2022-31660 · GHSA-gc6x-jwj2-5837

VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a…

LOW 36

VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01145 Published 2022-08-05 No fix listed

TI-2022-13577 CVE-2022-31658 · GHSA-5jrr-qcmv-7pvq

Injection in VMware Workspace ONE Access, Identity Manager and vRealize Automation

LOW 36

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0226 Published 2022-08-05 No fix listed CWE-74

TI-2021-05095 CVE-2021-22056 · GHSA-vr56-q77c-x8pg

Server-side request forgery in VMware Workspace ONE Access and Identity Manager

LOW 36

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01609 Published 2021-12-20 No fix listed CWE-918

TI-2022-13581 CVE-2022-31662 · GHSA-6xw4-c3mm-xc5r

Path traversal in VMware Workspace ONE Access, Access Connector, Identity Manager, vIDM…

LOW 35

VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01264 Published 2022-08-05 No fix listed CWE-22

TI-2021-05047 CVE-2021-22003 · GHSA-24wr-gx4f-pwrh

Missing brute-force protection in VMware Workspace ONE Access and Identity Manager

LOW 35

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2021-08-31 No fix listed CWE-307

TI-2022-13583 CVE-2022-31664 · GHSA-qh6g-q5gx-px23

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege…

LOW 34

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00327 Published 2022-08-05 No fix listed

TI-2022-13580 CVE-2022-31661 · GHSA-9x7x-rxxp-r268

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two…

LOW 34

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00334 Published 2022-08-05 No fix listed

TI-2016-04627 CVE-2016-5335 · GHSA-26wf-vqvv-w3p8

VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow…

LOW 34

VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00343 Published 2016-08-31 No fix listed

TI-2022-13582 CVE-2022-31663 · GHSA-2jf2-rvm2-72fv

Cross-site scripting in VMware Workspace ONE Access, Identity Manager and vRealize…

LOW 28

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00686 Published 2022-08-05 No fix listed CWE-79

TI-2016-04626 CVE-2016-5334 · GHSA-xgc4-84f6-p6xr

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow…

LOW 28

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02133 Published 2016-12-29 No fix listed CWE-668

Open these records in search →