VMware flaws being used in attacks
CISA lists 26 flaws in VMware products as being used in attacks, most recently on 4 Mar 2025. 9 have been used in ransomware.
VMwareBeing used in attacks
- On CISA’s list
- 26 flaws, added between 3 Nov 2021 and 4 Mar 2025
- Most recent
- CVE-2025-22226, VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability, added 4 Mar 2025
- Used in ransomware
- 9 flaws, according to CISA
- Products
- vCenter Server (9), ESXi (3), Multiple Products (3), Aria Operations for Networks (1), ESXi and Workstation (1), and 9 more
What to do
- Update every VMware product you use.Install the updates VMware offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- VMware ESXi, Workstation, and Fusion
CVE-2025-22226VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityVMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - VMware ESXi
CVE-2025-22225VMware ESXi Arbitrary Write VulnerabilityVMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - VMware ESXi and Workstation
CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityVMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - VMware vCenter Server
CVE-2024-38813VMware vCenter Server Privilege Escalation VulnerabilityVMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - VMware vCenter Server
CVE-2024-38812VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityVMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - VMware ESXi
CVE-2024-37085VMware ESXi Authentication Bypass VulnerabilityVMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - VMware vCenter Server
CVE-2022-22948VMware vCenter Server Incorrect Default File Permissions VulnerabilityVMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - VMware vCenter Server
CVE-2023-34048VMware vCenter Server Out-of-Bounds Write VulnerabilityVMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - VMware Tools
CVE-2023-20867VMware Tools Authentication Bypass VulnerabilityVMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.CISA’s required actionApply updates per vendor instructions. - VMware Aria Operations for Networks
CVE-2023-20887Vmware Aria Operations for Networks Command Injection VulnerabilityVMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.CISA’s required actionApply updates per vendor instructions. - VMware Spring Cloud Gateway
CVE-2022-22947VMware Spring Cloud Gateway Code Injection VulnerabilitySpring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.CISA’s required actionApply updates per vendor instructions. - VMware Multiple Products
CVE-2022-22960VMware Multiple Products Privilege Escalation VulnerabilityVMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.CISA’s required actionApply updates per vendor instructions. - VMware Workspace ONE Access and Identity Manager
CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection VulnerabilityVMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.CISA’s required actionApply updates per vendor instructions. - VMware Spring Framework
CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution VulnerabilitySpring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.CISA’s required actionApply updates per vendor instructions. - VMware SD-WAN Edge
CVE-2018-6961VMware SD-WAN Edge by VeloCloud Command Injection VulnerabilityVMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.CISA’s required actionApply updates per vendor instructions. - VMware vCenter Server and Cloud Foundation
CVE-2021-21973VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) VulnerabilityVMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.CISA’s required actionApply updates per vendor instructions. - VMware vRealize Operations Manager API
CVE-2021-21975VMware Server Side Request Forgery in vRealize Operations Manager APIServer Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.CISA’s required actionApply updates per vendor instructions. - VMware vCenter Server
CVE-2021-22017VMware vCenter Server Improper Access ControlRhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.CISA’s required actionApply updates per vendor instructions. - VMware vCenter Server
CVE-2021-22005VMware vCenter Server File Upload VulnerabilityVMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.CISA’s required actionApply updates per vendor instructions. - VMware vCenter Server
CVE-2021-21985VMware vCenter Server Improper Input Validation VulnerabilityVMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - VMware vCenter Server
CVE-2021-21972VMware vCenter Server Remote Code Execution VulnerabilityVMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.CISA’s required actionApply updates per vendor instructions. - VMware Multiple Products
CVE-2020-4006Multiple VMware Products Command Injection VulnerabilityVMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.CISA’s required actionApply updates per vendor instructions. - VMware ESXi
CVE-2020-3992VMware ESXi OpenSLP Use-After-Free VulnerabilityVMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.CISA’s required actionApply updates per vendor instructions. - VMware vCenter Server
CVE-2020-3952VMware vCenter Server Information Disclosure VulnerabilityVMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.CISA’s required actionApply updates per vendor instructions. - VMware Multiple Products
CVE-2020-3950VMware Multiple Products Privilege Escalation VulnerabilityVMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.CISA’s required actionApply updates per vendor instructions. - VMware ESXi and Horizon DaaS
CVE-2019-5544VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityVMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. VMware on CISA’s site.