How we count
Every figure on this page is a direct count of entries in CISA’s Known Exploited Vulnerabilities catalog attributed by CISA to VMware (KEV field vendorProject), refreshed daily. “Ransomware-linked” counts entries CISA marks as known to be used in ransomware campaigns; the remainder are “unknown” to CISA, not confirmed ransomware-free. A KEV listing means the vulnerability has been observed exploited in the wild. Snapshot as of 2026-08-31.
Exploited VMware vulnerabilities (CISA KEV)
| CVE | Product | Vulnerability | Added | |
|---|---|---|---|---|
| CVE-2025-22226 | ESXi, Workstation, and Fusion | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 2025-03-04 | |
| CVE-2025-22225 | ESXi | VMware ESXi Arbitrary Write Vulnerability | 2025-03-04 | ransomware |
| CVE-2025-22224 | ESXi and Workstation | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 2025-03-04 | |
| CVE-2024-38813 | vCenter Server | VMware vCenter Server Privilege Escalation Vulnerability | 2024-11-20 | |
| CVE-2024-38812 | vCenter Server | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 2024-11-20 | |
| CVE-2024-37085 | ESXi | VMware ESXi Authentication Bypass Vulnerability | 2024-07-30 | ransomware |
| CVE-2022-22948 | vCenter Server | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 2024-07-17 | |
| CVE-2023-34048 | vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | 2024-01-22 | |
| CVE-2023-20867 | Tools | VMware Tools Authentication Bypass Vulnerability | 2023-06-23 | |
| CVE-2023-20887 | Aria Operations for Networks | Vmware Aria Operations for Networks Command Injection Vulnerability | 2023-06-22 | |
| CVE-2022-22963 | Spring Cloud | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | 2022-08-25 | |
| CVE-2022-22947 | Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | 2022-05-16 | |
| CVE-2022-22960 | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 2022-04-15 | |
| CVE-2022-22954 | Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 2022-04-14 | ransomware |
| CVE-2022-22965 | Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 2022-04-04 | |
| CVE-2020-5410 | Spring Cloud Configuration (Config) Server | VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability | 2022-03-25 | |
| CVE-2018-6961 | SD-WAN Edge | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 2022-03-25 | |
| CVE-2018-1273 | Spring Data Commons | VMware Tanzu Spring Data Commons Property Binder Vulnerability | 2022-03-25 | ransomware |
| CVE-2021-21973 | vCenter Server and Cloud Foundation | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 2022-03-07 | |
| CVE-2021-21975 | vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | 2022-01-18 | ransomware |
| CVE-2021-22017 | vCenter Server | VMware vCenter Server Improper Access Control | 2022-01-10 | |
| CVE-2019-5544 | VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | 2021-11-03 | ransomware |
| CVE-2020-3992 | ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | 2021-11-03 | ransomware |
| CVE-2020-3950 | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 2021-11-03 | |
| CVE-2021-22005 | vCenter Server | VMware vCenter Server File Upload Vulnerability | 2021-11-03 | ransomware |
| CVE-2020-3952 | vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | 2021-11-03 | |
| CVE-2021-21972 | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 2021-11-03 | ransomware |
| CVE-2021-21985 | vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | 2021-11-03 | ransomware |
| CVE-2020-4006 | Multiple Products | Multiple VMware Products Command Injection Vulnerability | 2021-11-03 |
← All vendors by exploited-vulnerability count
🤖 Generated by defend.network from the CISA KEV catalog. Counts are deterministic aggregates of official CISA data; verify individual advisories at the linked sources.