VMware: exploited vulnerabilities
- 26exploited vulnerabilities
- 9used by ransomware
- Mar 4, 2025latest one added
- vCenter Server 9
- ESXi 3
- Multiple Products 3
- ESXi, Workstation, and Fusion 1
- ESXi and Workstation 1
- Tools 1
- Aria Operations for Networks 1
- Spring Cloud Gateway 1
- Workspace ONE Access and Identity Manager 1
- Spring Framework 1
- SD-WAN Edge 1
- vCenter Server and Cloud Foundation 1
- vRealize Operations Manager API 1
- VMware ESXi and Horizon DaaS 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 4, 2025 | Information Disclosure | ESXi, Workstation, and Fusion | High 7.1 | 1.6% |
| Mar 4, 2025 | Arbitrary Write | ESXi | High 8.2 | 1.0% |
| Mar 4, 2025 | TOCTOU Race Condition | ESXi and Workstation | Critical 9.3 | 1.6% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Jul 30, 2024 | Authentication Bypass | ESXi | Medium 6.8 | 27% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Medium 6.5 | 13% |
| Jan 22, 2024 | Out-of-Bounds Write | vCenter Server | Critical 9.8 | 99.2% |
| Jun 23, 2023 | Authentication Bypass | Tools | Low 3.9 | 14% |
| Jun 22, 2023 | Command Injection | Aria Operations for Networks | Critical 9.8 | 98% |
| May 16, 2022 | Code Injection | Spring Cloud Gateway | Critical 10.0 | 98% |
| Apr 15, 2022 | Privilege Escalation | Multiple Products | High 7.8 | 36% |
| Apr 14, 2022 | Server-Side Template Injection | Workspace ONE Access and Identity Manager | Critical 9.8 | >99.9% |
| Apr 4, 2022 | JDK 9+ Remote Code Execution | Spring Framework | Critical 9.8 | 99.6% |
| Mar 25, 2022 | by VeloCloud Command Injection | SD-WAN Edge | High 8.1 | 85% |
| Mar 7, 2022 | Server Side Request Forgery (SSRF) | vCenter Server and Cloud Foundation | Medium 5.3 | 88% |
| Jan 18, 2022 | Server Side Request Forgery in vRealize Operations Manager API | vRealize Operations Manager API | Critical 9.8 | 78% |
| Jan 10, 2022 | Improper Access Control | vCenter Server | Medium 5.3 | 49% |
| Nov 3, 2021 | File Upload | vCenter Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Improper Input Validation | vCenter Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | vCenter Server | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Multiple VMware Products Command Injection | Multiple Products | Critical 9.1 | 17% |
| Nov 3, 2021 | OpenSLP Use-After-Free | ESXi | Critical 9.8 | 83% |
| Nov 3, 2021 | Information Disclosure | vCenter Server | Critical 9.8 | 90% |
| Nov 3, 2021 | Privilege Escalation | Multiple Products | High 7.8 | 7.3% |
| Nov 3, 2021 | ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow | VMware ESXi and Horizon DaaS | Critical 9.8 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.