VMware known exploited vulnerabilities
The Beam CVE database tracks 26 known exploited vulnerabilities for VMware: 14 critical, 7 high, 4 medium and 1 low severity. The newest is CVE-2025-22224, published Mar 4, 2025.
These are the VMware vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 26
- Critical
- 14
- Known exploited (CISA KEV)
- 26
- Published in the last 30 days
- 0
All entries, newest first
CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
high8.2ExploitedMar 4, 2025CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
high8.2ExploitedMar 4, 2025CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
medium6.0ExploitedMar 4, 2025CVE-2024-38812
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
critical9.8ExploitedSep 17, 2024CVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability
critical9.8ExploitedSep 17, 2024CVE-2024-37085
VMware ESXi Authentication Bypass Vulnerability
high7.2ExploitedJun 25, 2024CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
critical9.8ExploitedOct 25, 2023CVE-2023-20867
VMware Tools Authentication Bypass Vulnerability
low3.9ExploitedJun 13, 2023CVE-2023-20887
Vmware Aria Operations for Networks Command Injection Vulnerability
critical9.8ExploitedJun 7, 2023CVE-2022-22960
VMware Multiple Products Privilege Escalation Vulnerability
high7.8ExploitedApr 13, 2022CVE-2022-22954
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
critical9.8ExploitedApr 11, 2022CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
critical9.8ExploitedApr 1, 2022CVE-2022-22948
VMware vCenter Server Incorrect Default File Permissions Vulnerability
medium6.5ExploitedMar 29, 2022CVE-2022-22947
VMware Spring Cloud Gateway Code Injection Vulnerability
critical10.0ExploitedMar 3, 2022CVE-2021-22005
VMware vCenter Server File Upload Vulnerability
critical9.8ExploitedSep 23, 2021CVE-2021-22017
VMware vCenter Server Improper Access Control
medium5.3ExploitedSep 23, 2021CVE-2021-21985
VMware vCenter Server Improper Input Validation Vulnerability
critical9.8ExploitedMay 26, 2021CVE-2021-21975
VMware Server Side Request Forgery in vRealize Operations Manager API
high7.5ExploitedMar 31, 2021CVE-2021-21972
VMware vCenter Server Remote Code Execution Vulnerability
critical9.8ExploitedFeb 24, 2021CVE-2021-21973
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
medium5.3ExploitedFeb 24, 2021CVE-2020-4006
Multiple VMware Products Command Injection Vulnerability
critical9.1ExploitedNov 23, 2020CVE-2020-3992
VMware ESXi OpenSLP Use-After-Free Vulnerability
critical9.8ExploitedOct 20, 2020CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
critical9.8ExploitedApr 10, 2020CVE-2020-3950
VMware Multiple Products Privilege Escalation Vulnerability
high7.8ExploitedMar 17, 2020CVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
critical9.8ExploitedDec 6, 2019CVE-2018-6961
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
high8.1ExploitedJun 11, 2018