VMware — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for VMware with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 26 VMware vulnerabilities confirmed as exploited in the wild across 14 products; 9 of them (35%) are flagged as used in known ransomware campaigns. vCenter Server is the most-affected product, with 9 entries (35% of the total). CISA added 3 entries in 2025, compared with 5 in 2024. Across the 26 entries with an NVD CVSS score (100% of the total), the average score is 8.4; 14 entries are rated critical by NVD. The most recent addition is CVE-2025-22226 (VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability), added on 2025-03-04.
Affected products
| Product | Entries | Share |
|---|---|---|
| vCenter Server | 9 | 35% |
| ESXi | 3 | 12% |
| Multiple Products | 3 | 12% |
| ESXi, Workstation, and Fusion | 1 | 3.8% |
| ESXi and Workstation | 1 | 3.8% |
| Tools | 1 | 3.8% |
| Aria Operations for Networks | 1 | 3.8% |
| Spring Cloud Gateway | 1 | 3.8% |
| Workspace ONE Access and Identity Manager | 1 | 3.8% |
| Spring Framework | 1 | 3.8% |
| SD-WAN Edge | 1 | 3.8% |
| vCenter Server and Cloud Foundation | 1 | 3.8% |
| vRealize Operations Manager API | 1 | 3.8% |
| VMware ESXi and Horizon DaaS | 1 | 3.8% |
Entries added per year
By date added to the KEV catalog
Exploited VMware vulnerabilities (26)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2025-22226 | ESXi, Workstation, and Fusion | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 2025-03-04 | — | HIGH7.1 |
| CVE-2025-22225 | ESXi | VMware ESXi Arbitrary Write Vulnerability | 2025-03-04 | Known | HIGH8.2 |
| CVE-2025-22224 | ESXi and Workstation | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 2025-03-04 | — | CRITICAL9.3 |
| CVE-2024-38813 | vCenter Server | VMware vCenter Server Privilege Escalation Vulnerability | 2024-11-20 | — | HIGH7.5 |
| CVE-2024-38812 | vCenter Server | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 2024-11-20 | — | CRITICAL9.8 |
| CVE-2024-37085 | ESXi | VMware ESXi Authentication Bypass Vulnerability | 2024-07-30 | Known | MEDIUM6.8 |
| CVE-2022-22948 | vCenter Server | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 2024-07-17 | — | MEDIUM6.5 |
| CVE-2023-34048 | vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | 2024-01-22 | — | CRITICAL9.8 |
| CVE-2023-20867 | Tools | VMware Tools Authentication Bypass Vulnerability | 2023-06-23 | — | LOW3.9 |
| CVE-2023-20887 | Aria Operations for Networks | Vmware Aria Operations for Networks Command Injection Vulnerability | 2023-06-22 | — | CRITICAL9.8 |
| CVE-2022-22947 | Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | 2022-05-16 | — | CRITICAL10.0 |
| CVE-2022-22960 | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 2022-04-15 | — | HIGH7.8 |
| CVE-2022-22954 | Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 2022-04-14 | Known | CRITICAL9.8 |
| CVE-2022-22965 | Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 2022-04-04 | — | CRITICAL9.8 |
| CVE-2018-6961 | SD-WAN Edge | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 2022-03-25 | — | HIGH8.1 |
| CVE-2021-21973 | vCenter Server and Cloud Foundation | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 2022-03-07 | — | MEDIUM5.3 |
| CVE-2021-21975 | vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | 2022-01-18 | Known | HIGH7.5 |
| CVE-2021-22017 | vCenter Server | VMware vCenter Server Improper Access Control | 2022-01-10 | — | MEDIUM5.3 |
| CVE-2019-5544 | VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2020-3992 | ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2020-3950 | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 2021-11-03 | — | HIGH7.8 |
| CVE-2021-22005 | vCenter Server | VMware vCenter Server File Upload Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2020-3952 | vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | 2021-11-03 | — | CRITICAL9.8 |
| CVE-2021-21972 | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2021-21985 | vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2020-4006 | Multiple Products | Multiple VMware Products Command Injection Vulnerability | 2021-11-03 | — | CRITICAL9.1 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.