VMware

Records1182All Threatist records

Exploited (KEV)41In CISA KEV

CVSS critical188CVSS 9.0–10.0

CVSS high460CVSS 7.0–8.9

Exploited now

VMware records in CISA KEV

TI-2026-30225 Broadcom VMWare ESX Insufficient Logging Vulnerability HIGH 71KEV 2026-10-28 TI-2026-42442 Broadcom VMware vCenter Path Traversal Vulnerability CRITICAL 100KEV 2026-08-18 TI-2021-05093 Omnissa Workspace ONE Server-Side Request Forgery CRITICAL 92KEV 2026-03-09 TI-2026-18246 Broadcom VMware Aria Operations Command Injection Vulnerability CRITICAL 94KEV 2026-03-03 TI-2024-24610 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability CRITICAL 100KEV 2026-01-23 TI-2025-27491 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability CRITICAL 93KEV 2025-10-30

Components

Products in the NVD configurations · select one to filter the records

Workstation 213 records CRITICAL Esxi 140 records CRITICAL Cloud Foundation 135 records CRITICAL Fusion 131 records CRITICAL Player 89 records HIGH Esx 86 records CRITICAL Spring Framework 83 records CRITICAL Vcenter Server 81 records CRITICAL

Records

15 records in Workspace One Access · all components

TI-2022-07131 CVE-2022-22954 · GHSA-q7xc-35g4-g566

Code injection in VMware Workspace ONE Access and Identity Manager

CRITICAL 100KEV

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99998 Published 2022-04-11 No fix listed CWE-94

TI-2022-07137 CVE-2022-22960 · GHSA-8r7c-vjv4-wp6x

Incorrect permission assignment in VMware Workspace ONE Access, Identity Manager and…

CRITICAL 93KEV

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.35519 Published 2022-04-13 No fix listed CWE-732

TI-2022-07149 CVE-2022-22972 · GHSA-ffjg-mw44-7fw8

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an…

HIGH 75

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.56305 Published 2022-05-20 No fix listed

TI-2022-07133 CVE-2022-22956 · GHSA-54hw-pp59-j3rc

Improper authentication in VMware Workspace ONE Access

HIGH 73

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.49533 Published 2022-04-13 No fix listed CWE-287

TI-2022-07132 CVE-2022-22955 · GHSA-vv47-c6mc-7w69

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955…

MEDIUM 53

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0782 Published 2022-04-13 No fix listed

TI-2022-07134 CVE-2022-22957 · GHSA-cqx6-4jgp-26m2

Deserialization of untrusted data in VMware Workspace ONE Access, Identity Manager and…

MEDIUM 52

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.23307 Published 2022-04-13 No fix listed CWE-502

TI-2021-05046 CVE-2021-22002 · GHSA-35g3-x9xw-f42c

Improper authentication in VMware Workspace ONE Access, Identity Manager and vRealize…

MEDIUM 44

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01207 Published 2021-08-31 No fix listed CWE-287

TI-2021-05096 CVE-2021-22057 · GHSA-cvrp-6cg2-w64m

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass…

MEDIUM 40

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01167 Published 2021-12-20 No fix listed

TI-2022-07150 CVE-2022-22973 · GHSA-4hvh-jpvg-gwfm

VMware Workspace ONE Access and Identity Manager contain a privilege escalation…

LOW 39

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.02354 Published 2022-05-20 No fix listed

TI-2022-07135 CVE-2022-22958 · GHSA-h783-2f78-cqf2

Deserialization of untrusted data in VMware Workspace ONE Access, Identity Manager and…

LOW 37

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03066 Published 2022-04-13 No fix listed CWE-502

TI-2021-05095 CVE-2021-22056 · GHSA-vr56-q77c-x8pg

Server-side request forgery in VMware Workspace ONE Access and Identity Manager

LOW 36

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01609 Published 2021-12-20 No fix listed CWE-918

TI-2021-05047 CVE-2021-22003 · GHSA-24wr-gx4f-pwrh

Missing brute-force protection in VMware Workspace ONE Access and Identity Manager

LOW 35

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2021-08-31 No fix listed CWE-307

TI-2023-07300 CVE-2023-20884 · GHSA-mhgf-hv55-f778

Open redirect in VMware Workspace ONE Access , VMware Identity Manager , VMware Cloud…

LOW 27

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00348 Published 2023-05-30 No fix listed CWE-601

TI-2022-07138 CVE-2022-22961 · GHSA-mxr2-4h82-c6c3

Information disclosure in VMware Workspace ONE Access, Identity Manager and vRealize…

LOW 26

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00846 Published 2022-04-13 No fix listed CWE-200

TI-2022-07136 CVE-2022-22959 · GHSA-mchf-99pv-x6wc

Cross-site request forgery in VMware Workspace ONE Access, Identity Manager and vRealize…

LOW 21

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00505 Published 2022-04-13 No fix listed CWE-352

Open these records in search →