Read the docs

VMware

Records1182All Threatist records
Exploited (KEV)41In CISA KEV
CVSS critical188CVSS 9.0–10.0
CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV
TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability Priority HIGH 71KEV 2026-10-28TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-08-18TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery Priority CRITICAL 92KEV 2026-03-09TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability Priority CRITICAL 94KEV 2026-03-03TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability Priority CRITICAL 100KEV 2026-01-23TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability Priority CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records
Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

20 records in Vrealize Automation · all components

TI-2022-07131 CVE-2022-22954 · GHSA-q7xc-35g4-g566

Code injection in VMware Workspace ONE Access and Identity Manager

Priority CRITICAL 100KEV

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99998 Published 2022-04-11 No fix listed CWE-94
TI-2022-07133 CVE-2022-22956 · GHSA-54hw-pp59-j3rc

Improper authentication in VMware Workspace ONE Access

Priority HIGH 73

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.49533 Published 2022-04-13 No fix listed CWE-287
TI-2017-03078 CVE-2017-4947 · GHSA-7h28-vxhx-xhw6

Deserialization of untrusted data in VMware vRealize Automation

Priority MEDIUM 53

VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08588 Published 2018-01-29 Fixed in 1.3 CWE-502
TI-2018-05081 CVE-2018-6959 · GHSA-rg5g-5cq4-g4m7

Session fixation in VMware vRealize Automation

Priority MEDIUM 46

VMware vRealize Automation (vRA) prior to 7.4.0 contains a vulnerability in the handling of session IDs.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01993 Published 2018-04-13 Fixed in 7.4.0 CWE-384
TI-2016-06355 CVE-2016-7460 · GHSA-mhmr-f673-jqv8

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and…

Priority MEDIUM 43

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML docum…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.02146 Published 2016-12-29 No fix listed CWE-611
TI-2021-05078 CVE-2021-22036 · GHSA-xhgj-fcgm-66qp

Information disclosure in VMware vRealize Orchestrator

Priority LOW 31

VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00925 Published 2021-10-13 No fix listed CWE-200
TI-2018-05080 CVE-2018-6958 · GHSA-hvxm-j3vp-wx4q

Cross-site scripting in VMware vRealize Automation

Priority LOW 29

VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01042 Published 2018-04-13 Fixed in 7.3.1 CWE-79
Open these records in search →