Vulnerabilità per vendor · aggiornato a ogni pubblicazione
Vulnerabilità VMware: CVE sfruttate e nostre analisi
VMware ha 31 vulnerabilità nel catalogo CISA Known Exploited Vulnerabilities, 4 delle quali aggiunte negli ultimi 12 mesi e 10 note per l'uso in campagne ransomware. Qui sotto: l'analisi pubblicata da Zero Hunt Research sui prodotti VMware, poi le voci del catalogo dalla più recente, con la scadenza federale.
Catalogo CISA versione 2026.10.21, pubblicato il 2026-10-21 14:04 UTC.
31
CVE in CISA KEV
4
Aggiunte negli ultimi 12 mesi
10
Uso noto nel ransomware
1
Analisi Zero Hunt
Prodotti con più voci nel KEV: vCenter Server (9) · ESXi (3) · Multiple Products (3) · Aria Operations for Networks (1) · Brocade Fabric OS (1) · ESXi and Workstation (1)
Le nostre analisi delle vulnerabilità VMware
2026-08-15
VMware vCenter CVE-2026-59310: patch il 29 luglio, violato il 3 agostoCVE-2026-59310 è un directory traversal non autenticato CVSS 9.8 nel servizio Syslog di vCenter. Sfruttato cinque giorni dopo la patch per installare reverse_ssh. Ecco il runbook di remediation.
Tutte le 31 voci KEV
| Aggiunta | CVE | Prodotto e vulnerabilità | Scadenza federale | Segnalazioni | Nostra analisi |
|---|---|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | VMware vCenter Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. | 2026-08-21 | RansomwareTriage forense | Leggi → |
| 2026-03-03 | CVE-2026-22719 | VMware Aria Operations Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to re… | 2026-03-24 | — | |
| 2026-01-23 | CVE-2024-37079 | VMware vCenter Server Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially cra… | 2026-02-13 | — | |
| 2025-10-30 | CVE-2025-41244 | VMware Aria Operations and VMware Tools Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools instal… | 2025-11-20 | — | |
| 2025-04-28 | CVE-2025-1976 | Brocade Fabric OS Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. | 2025-05-19 | — | |
| 2025-03-04 | CVE-2025-22226 | ESXi, Workstation, and Fusion VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine… | 2025-03-25 | — | |
| 2025-03-04 | CVE-2025-22225 | ESXi VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. | 2025-03-25 | Ransomware | — |
| 2025-03-04 | CVE-2025-22224 | ESXi and Workstation VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privile… | 2025-03-25 | — | |
| 2024-11-20 | CVE-2024-38813 | vCenter Server VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a speciall… | 2024-12-11 | — | |
| 2024-11-20 | CVE-2024-38812 | vCenter Server VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute r… | 2024-12-11 | — | |
| 2024-07-30 | CVE-2024-37085 | ESXi VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user m… | 2024-08-20 | Ransomware | — |
| 2024-07-17 | CVE-2022-22948 | vCenter Server VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. | 2024-08-07 | — | |
| 2024-01-22 | CVE-2023-34048 | vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. | 2024-02-12 | — | |
| 2023-06-23 | CVE-2023-20867 | Tools VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality a… | 2023-07-14 | — | |
| 2023-06-22 | CVE-2023-20887 | Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execut… | 2023-07-13 | — | |
| 2022-05-16 | CVE-2022-22947 | Spring Cloud Gateway Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. | 2022-06-06 | — | |
| 2022-04-15 | CVE-2022-22960 | Multiple Products VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. | 2022-05-06 | — | |
| 2022-04-14 | CVE-2022-22954 | Workspace ONE Access and Identity Manager VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. | 2022-05-05 | Ransomware | — |
| 2022-04-04 | CVE-2022-22965 | Spring Framework Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. | 2022-04-25 | — | |
| 2022-03-25 | CVE-2018-6961 | SD-WAN Edge VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution. | 2022-04-15 | — | |
| 2022-03-07 | CVE-2021-21973 | vCenter Server and Cloud Foundation VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. | 2022-03-21 | — | |
| 2022-01-18 | CVE-2021-21975 | vRealize Operations Manager API Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrativ… | 2022-02-01 | Ransomware | — |
| 2022-01-10 | CVE-2021-22017 | vCenter Server Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | 2022-01-24 | — | |
| 2021-11-03 | CVE-2021-22005 | vCenter Server VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code. | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-21985 | vCenter Server VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution. | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-21972 | vCenter Server VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges… | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2020-4006 | Multiple Products VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 844… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-3992 | ESXi VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2020-3952 | vCenter Server VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful explo… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-3950 | Multiple Products VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2019-5544 | VMware ESXi and Horizon DaaS VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to p… | 2022-05-03 | Ransomware | — |
Fonte: catalogo CISA Known Exploited Vulnerabilities (dati pubblici). Le descrizioni sono di CISA, abbreviate. Verifica sempre l'advisory del vendor prima di intervenire. cisa.gov
Prima della patch: tre verifiche
- 01Confronta la versione e la configurazione esatte che usi con l'advisory del vendor. Avere il prodotto non significa essere esposti.
- 02Verifica la raggiungibilità: una falla sfruttata su un'interfaccia raggiungibile da internet, o da una postazione compromessa, passa in testa alla coda.
- 03Dove CISA indica il triage forense, oltre alla patch cerca tracce di compromissione: la correzione non elimina un attaccante entrato prima.
Domande
Quante vulnerabilità VMware ci sono nel catalogo CISA KEV?
31 nella versione 2026.10.21 del catalogo, la prima aggiunta il 2021-11-03 e la più recente il 2026-08-18. 4 sono state aggiunte negli ultimi 12 mesi.
Quali prodotti VMware hanno più vulnerabilità sfruttate?
Per numero di voci KEV: vCenter Server (9), ESXi (3), Multiple Products (3), Aria Operations for Networks (1), Brocade Fabric OS (1), ESXi and Workstation (1).
Le vulnerabilità VMware sono usate negli attacchi ransomware?
CISA indica 10 delle 31 voci VMware come note per l'uso in campagne ransomware. Nella tabella sono segnalate.
La prossima CVE VMware è sfruttabile nella tua rete?
Una voce KEV dice che una vulnerabilità è sfruttata da qualche parte. Zero Hunt risponde se è sfruttabile nel tuo ambiente: un red team AI autonomo su un'appliance on-premise, con AI privata, in black box o gray box e con una persona che approva ogni passo che conta.
Altri vendor: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · Zimbra · SAP · Atlassian · Zyxel · Progress · F5