Cyberfeed6 › Vendors › VMware
CISA lists 26 VMware vulnerabilities as exploited in real attacks, and 9 of them are known to be used in ransomware campaigns. Most entries concern vCenter Server, ESXi, Multiple Products, ESXi, Workstation, and Fusion.
Showing the 26 most recently added of 26. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2025-22226VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | ESXi, Workstation, and Fusion | 2025-03-04 | High (7.1) | No | Vendor notice |
| CVE-2025-22225VMware ESXi Arbitrary Write Vulnerability | ESXi | 2025-03-04 | High (8.2) | Yes | Vendor notice |
| CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | ESXi and Workstation | 2025-03-04 | Critical (9.3) | No | Vendor notice |
| CVE-2024-38813VMware vCenter Server Privilege Escalation Vulnerability | vCenter Server | 2024-11-20 | High (7.5) | No | Vendor notice |
| CVE-2024-38812VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | vCenter Server | 2024-11-20 | Critical (9.8) | No | Vendor notice |
| CVE-2024-37085VMware ESXi Authentication Bypass Vulnerability | ESXi | 2024-07-30 | Medium (6.8) | Yes | Vendor notice |
| CVE-2022-22948VMware vCenter Server Incorrect Default File Permissions Vulnerability | vCenter Server | 2024-07-17 | Medium (6.5) | No | Vendor notice |
| CVE-2023-34048VMware vCenter Server Out-of-Bounds Write Vulnerability | vCenter Server | 2024-01-22 | Critical (9.8) | No | Vendor notice |
| CVE-2023-20867VMware Tools Authentication Bypass Vulnerability | Tools | 2023-06-23 | Low (3.9) | No | Vendor notice |
| CVE-2023-20887Vmware Aria Operations for Networks Command Injection Vulnerability | Aria Operations for Networks | 2023-06-22 | Critical (9.8) | No | Vendor notice |
| CVE-2022-22947VMware Spring Cloud Gateway Code Injection Vulnerability | Spring Cloud Gateway | 2022-05-16 | Critical (10.0) | No | |
| CVE-2022-22960VMware Multiple Products Privilege Escalation Vulnerability | Multiple Products | 2022-04-15 | High (7.8) | No | |
| CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | Workspace ONE Access and Identity Manager | 2022-04-14 | Critical (9.8) | Yes | |
| CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution Vulnerability | Spring Framework | 2022-04-04 | Critical (9.8) | No | |
| CVE-2018-6961VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | SD-WAN Edge | 2022-03-25 | High (8.1) | No | |
| CVE-2021-21973VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | vCenter Server and Cloud Foundation | 2022-03-07 | Medium (5.3) | No | |
| CVE-2021-21975VMware Server Side Request Forgery in vRealize Operations Manager API | vRealize Operations Manager API | 2022-01-18 | Critical (9.8) | Yes | |
| CVE-2021-22017VMware vCenter Server Improper Access Control | vCenter Server | 2022-01-10 | Medium (5.3) | No | |
| CVE-2021-22005VMware vCenter Server File Upload Vulnerability | vCenter Server | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2021-21985VMware vCenter Server Improper Input Validation Vulnerability | vCenter Server | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2021-21972VMware vCenter Server Remote Code Execution Vulnerability | vCenter Server | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2020-4006Multiple VMware Products Command Injection Vulnerability | Multiple Products | 2021-11-03 | Critical (9.1) | No | |
| CVE-2020-3992VMware ESXi OpenSLP Use-After-Free Vulnerability | ESXi | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2020-3952VMware vCenter Server Information Disclosure Vulnerability | vCenter Server | 2021-11-03 | Critical (9.8) | No | |
| CVE-2020-3950VMware Multiple Products Privilege Escalation Vulnerability | Multiple Products | 2021-11-03 | High (7.8) | No | |
| CVE-2019-5544VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | VMware ESXi and Horizon DaaS | 2021-11-03 | Critical (9.8) | Yes |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.