VMware: every exploited CVE on CISA KEV
All 26 VMware bugs attackers are confirmed to be using, with attack scores and free detection rules.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
26
VMware bugs on CISA’s exploited list
0 added in 2026.
9
are linked to ransomware
Every VMware vulnerability the US government has confirmed attackers are using, newest first, with each bug’s EPSS (predicted attack chance) and VEDAS (exploit evidence) scores and any free Nuclei or Suricata detection rule. US federal agencies must fix KEV-listed bugs by a deadline; everyone else should treat the list as “patch first”.
| Added | CVE | Product | Bug | EPSS | VEDAS | Detection rule | Ransomware |
|---|---|---|---|---|---|---|---|
| 2025-03-04 | CVE-2025-22226 | VMware ESXi, Workstation, and Fusion | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 0.02 | 0.97 | Out of scope (local) | No |
| 2025-03-04 | CVE-2025-22225 | VMware ESXi | VMware ESXi Arbitrary Write Vulnerability | 0.01 | 0.97 | Out of scope (local) | Yes |
| 2025-03-04 | CVE-2025-22224 | VMware ESXi and Workstation | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 0.02 | 0.98 | Out of scope (local) | No |
| 2024-11-20 | CVE-2024-38813 | VMware vCenter Server | VMware vCenter Server Privilege Escalation Vulnerability | 0.17 | 0.76 | None yet | No |
| 2024-11-20 | CVE-2024-38812 | VMware vCenter Server | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 0.55 | 0.82 | None yet | No |
| 2024-07-30 | CVE-2024-37085 | VMware ESXi | VMware ESXi Authentication Bypass Vulnerability | 0.27 | 0.98 | None yet | Yes |
| 2024-07-17 | CVE-2022-22948 | VMware vCenter Server | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 0.13 | 0.97 | None yet | No |
| 2024-01-22 | CVE-2023-34048 | VMware vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | 0.99 | 0.99 | Nuclei · Suricata | No |
| 2023-06-23 | CVE-2023-20867 | VMware Tools | VMware Tools Authentication Bypass Vulnerability | 0.14 | 0.98 | Out of scope (local) | No |
| 2023-06-22 | CVE-2023-20887 | VMware Aria Operations for Networks | Vmware Aria Operations for Networks Command Injection Vulnerability | 0.98 | 0.98 | Nuclei · Suricata | No |
| 2022-05-16 | CVE-2022-22947 | VMware Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | 0.98 | 0.98 | Nuclei · Suricata | No |
| 2022-04-15 | CVE-2022-22960 | VMware Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 0.36 | 0.98 | Out of scope (local) | No |
| 2022-04-14 | CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | Yes |
| 2022-04-04 | CVE-2022-22965 | VMware Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 1.00 | 0.99 | Nuclei · Suricata | No |
| 2022-03-25 | CVE-2018-6961 | VMware SD-WAN Edge | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 0.85 | 0.98 | Nuclei · Suricata | No |
| 2022-03-07 | CVE-2021-21973 | VMware vCenter Server and Cloud Foundation | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | 0.88 | 0.98 | Nuclei · Suricata | No |
| 2022-01-18 | CVE-2021-21975 | VMware vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | 0.78 | 0.98 | Nuclei · Suricata | Yes |
| 2022-01-10 | CVE-2021-22017 | VMware vCenter Server | VMware vCenter Server Improper Access Control | 0.49 | 0.98 | Nuclei · Suricata | No |
| 2021-11-03 | CVE-2021-22005 | VMware vCenter Server | VMware vCenter Server File Upload Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2021-21985 | VMware vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2021-21972 | VMware vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | 1.00 | 0.98 | Nuclei · Suricata | Yes |
| 2021-11-03 | CVE-2020-4006 | VMware Multiple Products | Multiple VMware Products Command Injection Vulnerability | 0.17 | 0.98 | None yet | No |
| 2021-11-03 | CVE-2020-3992 | VMware ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | 0.83 | 0.98 | None yet | Yes |
| 2021-11-03 | CVE-2020-3952 | VMware vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | 0.90 | 0.98 | Nuclei · Suricata | No |
| 2021-11-03 | CVE-2020-3950 | VMware Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 0.07 | 0.98 | Out of scope (local) | No |
| 2021-11-03 | CVE-2019-5544 | VMware VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | 0.98 | 0.98 | Nuclei · Suricata | Yes |
Industry partners
