Vulnerabilities by vendor · updated on every deploy
VMware vulnerabilities: exploited CVEs and our analysis
VMware has 31 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 4 of them added in the last 12 months and 10 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on VMware products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
31
CVEs in CISA KEV
4
Added in the last 12 months
10
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: vCenter Server (9) · ESXi (3) · Multiple Products (3) · Aria Operations for Networks (1) · Brocade Fabric OS (1) · ESXi and Workstation (1)
Our analysis of VMware vulnerabilities
2026-08-15
VMware vCenter CVE-2026-59310: Patched July 29, Breached August 3CVE-2026-59310 is an unauthenticated CVSS 9.8 directory traversal in the vCenter Syslog service. Exploited five days after the patch to plant reverse_ssh. Here's the fix runbook.
All 31 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | VMware vCenter Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. | 2026-08-21 | RansomwareForensic triage | Read → |
| 2026-03-03 | CVE-2026-22719 | VMware Aria Operations Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to re… | 2026-03-24 | — | |
| 2026-01-23 | CVE-2024-37079 | VMware vCenter Server Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially cra… | 2026-02-13 | — | |
| 2025-10-30 | CVE-2025-41244 | VMware Aria Operations and VMware Tools Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools instal… | 2025-11-20 | — | |
| 2025-04-28 | CVE-2025-1976 | Brocade Fabric OS Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. | 2025-05-19 | — | |
| 2025-03-04 | CVE-2025-22226 | ESXi, Workstation, and Fusion VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine… | 2025-03-25 | — | |
| 2025-03-04 | CVE-2025-22225 | ESXi VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. | 2025-03-25 | Ransomware | — |
| 2025-03-04 | CVE-2025-22224 | ESXi and Workstation VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privile… | 2025-03-25 | — | |
| 2024-11-20 | CVE-2024-38813 | vCenter Server VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a speciall… | 2024-12-11 | — | |
| 2024-11-20 | CVE-2024-38812 | vCenter Server VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute r… | 2024-12-11 | — | |
| 2024-07-30 | CVE-2024-37085 | ESXi VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user m… | 2024-08-20 | Ransomware | — |
| 2024-07-17 | CVE-2022-22948 | vCenter Server VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. | 2024-08-07 | — | |
| 2024-01-22 | CVE-2023-34048 | vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. | 2024-02-12 | — | |
| 2023-06-23 | CVE-2023-20867 | Tools VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality a… | 2023-07-14 | — | |
| 2023-06-22 | CVE-2023-20887 | Aria Operations for Networks VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execut… | 2023-07-13 | — | |
| 2022-05-16 | CVE-2022-22947 | Spring Cloud Gateway Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. | 2022-06-06 | — | |
| 2022-04-15 | CVE-2022-22960 | Multiple Products VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. | 2022-05-06 | — | |
| 2022-04-14 | CVE-2022-22954 | Workspace ONE Access and Identity Manager VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. | 2022-05-05 | Ransomware | — |
| 2022-04-04 | CVE-2022-22965 | Spring Framework Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. | 2022-04-25 | — | |
| 2022-03-25 | CVE-2018-6961 | SD-WAN Edge VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution. | 2022-04-15 | — | |
| 2022-03-07 | CVE-2021-21973 | vCenter Server and Cloud Foundation VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure. | 2022-03-21 | — | |
| 2022-01-18 | CVE-2021-21975 | vRealize Operations Manager API Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrativ… | 2022-02-01 | Ransomware | — |
| 2022-01-10 | CVE-2021-22017 | vCenter Server Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | 2022-01-24 | — | |
| 2021-11-03 | CVE-2021-22005 | vCenter Server VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code. | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-21985 | vCenter Server VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution. | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2021-21972 | vCenter Server VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges… | 2021-11-17 | Ransomware | — |
| 2021-11-03 | CVE-2020-4006 | Multiple Products VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 844… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-3992 | ESXi VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2020-3952 | vCenter Server VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful explo… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-3950 | Multiple Products VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2019-5544 | VMware ESXi and Horizon DaaS VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to p… | 2022-05-03 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many VMware vulnerabilities are in the CISA KEV catalog?
31 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-08-18. 4 were added in the last 12 months.
Which VMware products have the most exploited vulnerabilities?
By KEV entries: vCenter Server (9), ESXi (3), Multiple Products (3), Aria Operations for Networks (1), Brocade Fabric OS (1), ESXi and Workstation (1).
Are VMware vulnerabilities used in ransomware attacks?
CISA marks 10 of the 31 VMware entries as known to be used in ransomware campaigns. The table flags them.
Is the next VMware CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · Zimbra · SAP · Atlassian · Zyxel · Progress · F5