Vendor
VMware
1,151 known vulnerabilities in products by VMware, 40 of them actively exploited (CISA KEV).
Key figures
1,151
Vulnerabilities
40
Actively exploited (KEV)
11
Used by ransomware
161
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2026-59310 | vCenter directory-traversal vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-22005 | VMware vCenter Server File Upload Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-21985 | VMware vCenter Server Improper Input Validation Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-21972 | VMware vCenter Server Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2019-5544 | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2018-1273 | VMware Tanzu Spring Data Commons Property Binder Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2020-3992 | VMware ESXi OpenSLP Use-After-Free Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-21975 | VMware Server Side Request Forgery in vRealize Operations Manager API In CISA KEVRansomware | 7.5 | |
| Critical | CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability In CISA KEVRansomware | 6.8 | |
| Critical | CVE-2024-38812 | Heap-overflow vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-22719 | VMware Aria Operations command injection vulnerability In CISA KEV | 8.1 | |
| Critical | CVE-2024-37079 | Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2022-22963 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2022-22965 | Spring Framework JDK 9+ Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2014-6271 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2014-7169 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-11651 | SaltStack Salt Authentication Bypass Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-3952 | VMware vCenter Server Information Disclosure Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2025-41244 | Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2020-4006 | Multiple VMware Products Command Injection Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2018-6961 | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability In CISA KEV | 8.1 |
News
- 58 hardware vulnerabilities: A guide to the threatscsoonline,
- Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Codethehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomwarethehackernews,
- Critical VMware vCenter RCE flaw exploited for reverse SSH accessbleepingcomputer,