VMware known exploited vulnerabilities

CISA's Known Exploited Vulnerabilities catalog lists 26 VMware vulnerabilities: 0 added in the last 365 days, 14 rated critical (CVSS 9 or higher), and 9 with known ransomware use. The most recent was added Mar 4, 2025.

RSS feed for VMware exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant

Added to KEV	CVE	Vulnerability	CVSS	EPSS	Federal due date	Ransomware use
2025-03-04	CVE-2025-22224	VMware ESXi and Workstation TOCTOU Race Condition Vulnerability	9.3 (v3.1)	1.6%	2025-03-25	Unknown
2025-03-04	CVE-2025-22225	VMware ESXi Arbitrary Write Vulnerability	8.2 (v3.1)	1.0%	2025-03-25	Known
2025-03-04	CVE-2025-22226	VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability	7.1 (v3.1)	1.6%	2025-03-25	Unknown
2024-11-20	CVE-2024-38812	VMware vCenter Server Heap-Based Buffer Overflow Vulnerability	9.8 (v3.1)	54.6%	2024-12-11	Unknown
2024-11-20	CVE-2024-38813	VMware vCenter Server Privilege Escalation Vulnerability	7.5 (v3.1)	17.4%	2024-12-11	Unknown
2024-07-30	CVE-2024-37085	VMware ESXi Authentication Bypass Vulnerability	6.8 (v3.1)	26.8%	2024-08-20	Known
2024-07-17	CVE-2022-22948	VMware vCenter Server Incorrect Default File Permissions Vulnerability	6.5 (v3.1)	13.3%	2024-08-07	Unknown
2024-01-22	CVE-2023-34048	VMware vCenter Server Out-of-Bounds Write Vulnerability	9.8 (v3.1)	99.2%	2024-02-12	Unknown
2023-06-23	CVE-2023-20867	VMware Tools Authentication Bypass Vulnerability	3.9 (v3.1)	13.6%	2023-07-14	Unknown
2023-06-22	CVE-2023-20887	Vmware Aria Operations for Networks Command Injection Vulnerability	9.8 (v3.1)	98.3%	2023-07-13	Unknown
2022-05-16	CVE-2022-22947	VMware Spring Cloud Gateway Code Injection Vulnerability	10 (v3.1)	98.3%	2022-06-06	Unknown
2022-04-15	CVE-2022-22960	VMware Multiple Products Privilege Escalation Vulnerability	7.8 (v3.1)	35.5%	2022-05-06	Unknown
2022-04-14	CVE-2022-22954	VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability	9.8 (v3.1)	>99.9%	2022-05-05	Known
2022-04-04	CVE-2022-22965	Spring Framework JDK 9+ Remote Code Execution Vulnerability	9.8 (v3.1)	99.6%	2022-04-25	Unknown
2022-03-25	CVE-2018-6961	VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability	8.1 (v3.1)	85.3%	2022-04-15	Unknown
2022-03-07	CVE-2021-21973	VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability	5.3 (v3.1)	88.0%	2022-03-21	Unknown
2022-01-18	CVE-2021-21975	VMware Server Side Request Forgery in vRealize Operations Manager API	7.5 (v3.1)	78.0%	2022-02-01	Known
2022-01-10	CVE-2021-22017	VMware vCenter Server Improper Access Control	5.3 (v3.1)	49.2%	2022-01-24	Unknown
2021-11-03	CVE-2019-5544	VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability	9.8 (v3.1)	98.1%	2022-05-03	Known
2021-11-03	CVE-2020-3950	VMware Multiple Products Privilege Escalation Vulnerability	7.8 (v3.1)	7.3%	2022-05-03	Unknown
2021-11-03	CVE-2020-3952	VMware vCenter Server Information Disclosure Vulnerability	9.8 (v3.1)	90.4%	2022-05-03	Unknown
2021-11-03	CVE-2020-3992	VMware ESXi OpenSLP Use-After-Free Vulnerability	9.8 (v3.1)	83.0%	2022-05-03	Known
2021-11-03	CVE-2020-4006	VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability	9.1 (v3.1)	17.3%	2022-05-03	Unknown
2021-11-03	CVE-2021-21972	VMware vCenter Server Remote Code Execution Vulnerability	9.8 (v3.1)	99.9%	2021-11-17	Known
2021-11-03	CVE-2021-21985	VMware vCenter Server Improper Input Validation Vulnerability	9.8 (v3.1)	>99.9%	2021-11-17	Known
2021-11-03	CVE-2021-22005	VMware vCenter Server File Upload Vulnerability	9.8 (v3.1)	>99.9%	2021-11-17	Known