Vendor
VMware vulnerabilities under active attack
26 VMware vulnerabilities have confirmed evidence of exploitation in the wild, and 9 are used in ransomware campaigns.
26
confirmed exploited
9
used in ransomware
26
past fix deadline
- CVE-2025-22226 VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability VMware · ESXi, Workstation, and Fusion
- CVE-2025-22225 VMware ESXi Arbitrary Write Vulnerability VMware · ESXi
- CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability VMware · ESXi and Workstation
- CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability VMware · vCenter Server
- CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability VMware · vCenter Server
- CVE-2024-37085 VMware ESXi Authentication Bypass Vulnerability VMware · ESXi
- CVE-2022-22948 VMware vCenter Server Incorrect Default File Permissions Vulnerability VMware · vCenter Server
- CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Vulnerability VMware · vCenter Server
- CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability VMware · Tools
- CVE-2023-20887 Vmware Aria Operations for Networks Command Injection Vulnerability VMware · Aria Operations for Networks
- CVE-2022-22947 VMware Spring Cloud Gateway Code Injection Vulnerability VMware · Spring Cloud Gateway
- CVE-2022-22960 VMware Multiple Products Privilege Escalation Vulnerability VMware · Multiple Products
- CVE-2022-22954 VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability VMware · Workspace ONE Access and Identity Manager
- CVE-2022-22965 Spring Framework JDK 9+ Remote Code Execution Vulnerability VMware · Spring Framework
- CVE-2018-6961 VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability VMware · SD-WAN Edge
- CVE-2021-21973 VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability VMware · vCenter Server and Cloud Foundation
- CVE-2021-21975 VMware Server Side Request Forgery in vRealize Operations Manager API VMware · vRealize Operations Manager API
- CVE-2021-22017 VMware vCenter Server Improper Access Control VMware · vCenter Server
- CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability VMware · VMware ESXi and Horizon DaaS
- CVE-2020-3992 VMware ESXi OpenSLP Use-After-Free Vulnerability VMware · ESXi
- CVE-2020-3950 VMware Multiple Products Privilege Escalation Vulnerability VMware · Multiple Products
- CVE-2021-22005 VMware vCenter Server File Upload Vulnerability VMware · vCenter Server
- CVE-2020-3952 VMware vCenter Server Information Disclosure Vulnerability VMware · vCenter Server
- CVE-2021-21972 VMware vCenter Server Remote Code Execution Vulnerability VMware · vCenter Server
- CVE-2021-21985 VMware vCenter Server Improper Input Validation Vulnerability VMware · vCenter Server
- CVE-2020-4006 Multiple VMware Products Command Injection Vulnerability VMware · Multiple Products