Read the docs

VMware

Records1182All Threatist records
Exploited (KEV)41In CISA KEV
CVSS critical188CVSS 9.0–10.0
CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV
TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability Priority HIGH 71KEV 2026-10-28TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-08-18TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery Priority CRITICAL 92KEV 2026-03-09TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability Priority CRITICAL 94KEV 2026-03-03TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability Priority CRITICAL 100KEV 2026-01-23TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability Priority CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records
Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

81 records in Vcenter Server · all components

TI-2026-42442 CVE-2026-59310 · GHSA-v2gp-49gj-2c9f

vCenter directory-traversal vulnerability

Priority CRITICAL 100KEV

VMware vCenter contains a directory traversal vulnerability in the Syslog server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61668 Published 2026-07-30 Fixed in 9.1.0.0300, 9.0.2.0100 +1 CWE-22
TI-2024-26040 CVE-2024-38813 · GHSA-66vj-hxh5-x3jh

Privilege escalation in VMware vCenter Server

Priority CRITICAL 100KEV

The vCenter Server contains a privilege escalation vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.17355 Published 2024-09-17 Fixed in 8.0 U3b, 7.0 U3s CWE-250
TI-2024-26039 CVE-2024-38812 · GHSA-72q3-gvh6-6m6w

Heap-overflow in VMware vCenter Server

Priority CRITICAL 100KEV

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.54571 Published 2024-09-17 Fixed in 8.0 U3b, 7.0 U3s CWE-122
TI-2024-24610 CVE-2024-37079 · GHSA-qqfg-j9g4-4mfh

Out-of-bounds write in VMware vCenter Server

Priority CRITICAL 100KEV

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.22377 Published 2024-06-18 Fixed in 8.0 U2d, 8.0 U1e +1 CWE-787
TI-2023-16914 CVE-2023-34048 · GHSA-87j2-5g9j-7jmv

VMware vCenter Server Out-of-Bounds Write Vulnerability

Priority CRITICAL 100KEV

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99234 Published 2023-10-25 Fixed in 8.0U2, 7.0U3o CWE-787
TI-2021-05029 CVE-2021-21985 · GHSA-rg6m-2r9v-c5fj

Improper input validation in VMware vCenter Server and VMware Cloud Foundation

Priority CRITICAL 100KEV

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2021-05-26 No fix listed CWE-20
TI-2021-05017 CVE-2021-21972 · GHSA-c9cr-34rr-8gpr

Path traversal in VMware vCenter Server

Priority CRITICAL 100KEV

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99865 Published 2021-02-24 Fixed in 4.2, 3.10.1.2 CWE-22
TI-2020-03450 CVE-2020-3952 · GHSA-rqpw-v3g2-qccx

Missing authentication in VMware vCenter Server

Priority CRITICAL 100KEV

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.90384 Published 2020-04-10 No fix listed CWE-306
TI-2024-24611 CVE-2024-37080 · GHSA-mw3w-f2gc-g47m

Heap-based buffer overflow in VMware vCenter Server

Priority HIGH 82

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12478 Published 2024-06-18 Fixed in 8.0 U2d, 8.0 U1e +1 CWE-122
TI-2021-05018 CVE-2021-21973 · GHSA-5j6h-79mj-qfq2

Server-side request forgery in VMware vCenter Server

Priority HIGH 81KEV

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.88012 Published 2021-02-24 Fixed in 4.2, 3.10.1.2 CWE-918
TI-2023-07311 CVE-2023-20895 · GHSA-88h4-vqxf-pwjm

Out-of-bounds write in VMware vCenter Server

Priority HIGH 76

The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01375 Published 2023-06-22 Fixed in 8.0 U1b, 7.0 u3m +1 CWE-787
TI-2023-07310 CVE-2023-20894 · GHSA-8x4h-jr9x-82rr

Out-of-bounds write in VMware vCenter Server

Priority HIGH 76

The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33945 Published 2023-06-22 Fixed in 8.0 U1b, 7.0 u3m +1 CWE-787
TI-2023-07309 CVE-2023-20893 · GHSA-r9q7-6mw7-hmpc

Use after free in VMware vCenter Server

Priority HIGH 76

The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01248 Published 2023-06-22 Fixed in 8.0 U1b, 7.0 u3m +1 CWE-416
TI-2023-07308 CVE-2023-20892 · GHSA-vmcx-3r5m-96cr

VMware vCenter Server heap-overflow vulnerability

Priority HIGH 76

The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01849 Published 2023-06-22 Fixed in 8.0 U1b, 7.0 u3m +1 CWE-787
TI-2024-14861 CVE-2024-22274 · GHSA-xm44-79f8-q8r7

Code injection in VMware vCenter Server

Priority HIGH 67

The vCenter Server contains an authenticated remote code execution vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02509 Published 2024-05-21 Fixed in 8.0 U2b, 7.0 U3q +1 CWE-94
TI-2023-07312 CVE-2023-20896 · GHSA-fm8c-6m3x-v3rf

Out-of-bounds read in VMware vCenter Server

Priority HIGH 66

The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00901 Published 2023-06-22 Fixed in 8.0 U1b, 7.0 u3m +1 CWE-125
TI-2022-13599 CVE-2022-31680 · GHSA-5g3f-j849-rm6p

Deserialization of untrusted data in VMware vCenter Server

Priority MEDIUM 63

The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.31076 Published 2022-10-07 No fix listed CWE-502
TI-2021-05030 CVE-2021-21986 · GHSA-6qhw-394j-xwvg

Missing authentication in VMware vCenter Server and VMware Cloud Foundation

Priority MEDIUM 57

The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13265 Published 2021-05-26 No fix listed CWE-306
Load more
Open these records in search →