Vendor
VMware: actively exploited vulnerabilities
29 vulnerabilities in VMware products are listed in CISA’s catalog of actively exploited vulnerabilities, 10 of them used by ransomware. Latest addition on March 4, 2025: CVE-2025-22226 (ESXi, Workstation, and Fusion).
- 29 exploited vulnerabilities in the catalog
- 0 added in the last 12 months
- 10 used by ransomware
- 17 products affected
Affected products
- vCenter Server9
- ESXi3
- Multiple Products3
- Aria Operations for Networks1
- ESXi and Workstation1
- ESXi, Workstation, and Fusion1
- SD-WAN Edge1
- Spring Cloud1
- Spring Cloud Configuration (Config) Server1
- Spring Cloud Gateway1
- Spring Data Commons1
- Spring Framework1
- Tools1
- vCenter Server and Cloud Foundation1
- VMware ESXi and Horizon DaaS1
- vRealize Operations Manager API1
- Workspace ONE Access and Identity Manager1
All exploited vulnerabilities
CISA KEV catalog, newest first: each entry corresponds to observed exploitation.
2025 3 vulnerabilities
-
CVE-2025-22226VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
-
CVE-2025-22225Used by ransomwareVMware ESXi Arbitrary Write Vulnerability
-
CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
2024 5 vulnerabilities
-
CVE-2024-38813VMware vCenter Server Privilege Escalation Vulnerability
-
CVE-2024-38812VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
-
CVE-2024-37085Used by ransomwareVMware ESXi Authentication Bypass Vulnerability
-
CVE-2022-22948VMware vCenter Server Incorrect Default File Permissions Vulnerability
-
CVE-2023-34048VMware vCenter Server Out-of-Bounds Write Vulnerability
2023 2 vulnerabilities
-
CVE-2023-20867VMware Tools Authentication Bypass Vulnerability
-
CVE-2023-20887Vmware Aria Operations for Networks Command Injection Vulnerability
2022 11 vulnerabilities
-
CVE-2022-22963VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
-
CVE-2022-22947VMware Spring Cloud Gateway Code Injection Vulnerability
-
CVE-2022-22960VMware Multiple Products Privilege Escalation Vulnerability
-
CVE-2022-22954Used by ransomwareVMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
-
CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution Vulnerability
-
CVE-2020-5410VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability
-
CVE-2018-6961VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
-
CVE-2018-1273Used by ransomwareVMware Tanzu Spring Data Commons Property Binder Vulnerability
-
CVE-2021-21973VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
-
CVE-2021-21975Used by ransomwareVMware Server Side Request Forgery in vRealize Operations Manager API
-
CVE-2021-22017VMware vCenter Server Improper Access Control
2021 8 vulnerabilities
-
CVE-2021-22005Used by ransomwareVMware vCenter Server File Upload Vulnerability
-
CVE-2021-21985Used by ransomwareVMware vCenter Server Improper Input Validation Vulnerability
-
CVE-2021-21972Used by ransomwareVMware vCenter Server Remote Code Execution Vulnerability
-
CVE-2020-4006Multiple VMware Products Command Injection Vulnerability
-
CVE-2020-3992Used by ransomwareVMware ESXi OpenSLP Use-After-Free Vulnerability
-
CVE-2020-3952VMware vCenter Server Information Disclosure Vulnerability
-
CVE-2020-3950VMware Multiple Products Privilege Escalation Vulnerability
-
CVE-2019-5544Used by ransomwareVMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
What to do
If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.
Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.