VMware vulnerabilities in CISA KEV
VMware has 26 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 13th highest of any vendor. none were added in the last 12 months; 9 are linked to known ransomware use (34.6% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is vCenter Server, with 9 entries. Other frequently affected products: ESXi (3); Multiple Products (3).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor vmware --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
26
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2025-03-04
most recent entry
┌─ last 12 months
0
entries added
┌─ ransomware use
9 of 26
34.6% linked to ransomware
┌─ distinct products
14
affected products
$ awk -F, {print $1} /var/log/kev/vmware.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 8 | 5 |
| 2022 | 8 | 2 |
| 2023 | 2 | 0 |
| 2024 | 5 | 1 |
| 2025 | 3 | 1 |
$ sort /var/log/kev/vmware.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- vCenter Server 9 entries
- ESXi 3 entries
- Multiple Products 3 entries
- Aria Operations for Networks 1 entry
- ESXi and Workstation 1 entry
$ kev-due-dates --vendor vmware
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ VMware
21 days (range 14 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/vmware.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (26 of 26 have at least one CWE).
$ grep -ril 'VMware' /var/log/news | head -5
Our reporting that names VMware or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./vmware.kev · 26 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2025-22224
ESXi and Workstation
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
due 2025-03-25 · CWE-367
$ cat CVE-2025-22224.txt
Description. VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-22225
ESXi [RANSOMWARE]
VMware ESXi Arbitrary Write Vulnerability
due 2025-03-25 · CWE-123
$ cat CVE-2025-22225.txt
Description. VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-22226
ESXi, Workstation, and Fusion
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
due 2025-03-25 · CWE-125
$ cat CVE-2025-22226.txt
Description. VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-38812
vCenter Server
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
due 2024-12-11 · CWE-122
$ cat CVE-2024-38812.txt
Description. VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-38813
vCenter Server
VMware vCenter Server Privilege Escalation Vulnerability
due 2024-12-11 · CWE-250 CWE-273
$ cat CVE-2024-38813.txt
Description. VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-37085
ESXi [RANSOMWARE]
VMware ESXi Authentication Bypass Vulnerability
due 2024-08-20 · CWE-305
$ cat CVE-2024-37085.txt
Description. VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-22948
vCenter Server
VMware vCenter Server Incorrect Default File Permissions Vulnerability
due 2024-08-07 · CWE-276
$ cat CVE-2022-22948.txt
Description. VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-34048
vCenter Server
VMware vCenter Server Out-of-Bounds Write Vulnerability
due 2024-02-12 · CWE-787
$ cat CVE-2023-34048.txt
Description. VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-20867
Tools
VMware Tools Authentication Bypass Vulnerability
due 2023-07-14 · CWE-287
$ cat CVE-2023-20867.txt
Description. VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
Required action. Apply updates per vendor instructions.
- CVE-2023-20887
Aria Operations for Networks
Vmware Aria Operations for Networks Command Injection Vulnerability
due 2023-07-13 · CWE-77
$ cat CVE-2023-20887.txt
Description. VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2022-22947
Spring Cloud Gateway
VMware Spring Cloud Gateway Code Injection Vulnerability
due 2022-06-06 · CWE-94
$ cat CVE-2022-22947.txt
Description. Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
Required action. Apply updates per vendor instructions.
- CVE-2022-22960
Multiple Products
VMware Multiple Products Privilege Escalation Vulnerability
due 2022-05-06 · CWE-250
$ cat CVE-2022-22960.txt
Description. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
Required action. Apply updates per vendor instructions.
- CVE-2022-22954
Workspace ONE Access and Identity Manager [RANSOMWARE]
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
due 2022-05-05 · CWE-94
$ cat CVE-2022-22954.txt
Description. VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Required action. Apply updates per vendor instructions.
- CVE-2022-22965
Spring Framework
Spring Framework JDK 9+ Remote Code Execution Vulnerability
due 2022-04-25 · CWE-94
$ cat CVE-2022-22965.txt
Description. Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
Required action. Apply updates per vendor instructions.
- CVE-2018-6961
SD-WAN Edge
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
due 2022-04-15 · CWE-78
$ cat CVE-2018-6961.txt
Description. VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-21973
vCenter Server and Cloud Foundation
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
due 2022-03-21 · CWE-20 CWE-918
$ cat CVE-2021-21973.txt
Description. VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
Required action. Apply updates per vendor instructions.
- CVE-2021-21975
vRealize Operations Manager API [RANSOMWARE]
VMware Server Side Request Forgery in vRealize Operations Manager API
due 2022-02-01 · CWE-918
$ cat CVE-2021-21975.txt
Description. Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Required action. Apply updates per vendor instructions.
- CVE-2021-22017
vCenter Server
VMware vCenter Server Improper Access Control
due 2022-01-24 · CWE-23
$ cat CVE-2021-22017.txt
Description. Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Required action. Apply updates per vendor instructions.
- CVE-2019-5544
VMware ESXi and Horizon DaaS [RANSOMWARE]
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
due 2022-05-03 · CWE-787
$ cat CVE-2019-5544.txt
Description. VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-3950
Multiple Products
VMware Multiple Products Privilege Escalation Vulnerability
due 2022-05-03 · CWE-269
$ cat CVE-2020-3950.txt
Description. VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.
Required action. Apply updates per vendor instructions.
- CVE-2020-3952
vCenter Server
VMware vCenter Server Information Disclosure Vulnerability
due 2022-05-03 · CWE-306
$ cat CVE-2020-3952.txt
Description. VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
Required action. Apply updates per vendor instructions.
- CVE-2020-3992
ESXi [RANSOMWARE]
VMware ESXi OpenSLP Use-After-Free Vulnerability
due 2022-05-03 · CWE-416
$ cat CVE-2020-3992.txt
Description. VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-4006
Multiple Products
Multiple VMware Products Command Injection Vulnerability
due 2022-05-03 · CWE-78
$ cat CVE-2020-4006.txt
Description. VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.
Required action. Apply updates per vendor instructions.
- CVE-2021-21972
vCenter Server [RANSOMWARE]
VMware vCenter Server Remote Code Execution Vulnerability
due 2021-11-17 · CWE-23
$ cat CVE-2021-21972.txt
Description. VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
Required action. Apply updates per vendor instructions.
- CVE-2021-21985
vCenter Server [RANSOMWARE]
VMware vCenter Server Improper Input Validation Vulnerability
due 2021-11-17 · CWE-20 CWE-470 CWE-918
$ cat CVE-2021-21985.txt
Description. VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-22005
vCenter Server [RANSOMWARE]
VMware vCenter Server File Upload Vulnerability
due 2021-11-17 · CWE-23
$ cat CVE-2021-22005.txt
Description. VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Required action. Apply updates per vendor instructions.