{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: VMware vulnerabilities","home_page_url":"https://patchfirst.co/vendor/vmware/","feed_url":"https://patchfirst.co/feed/vendor/vmware.json","description":"New and newly exploited VMware CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-59346","url":"https://patchfirst.co/cve/CVE-2026-59346/","title":"CVE-2026-59346: VMware Workstation and Fusion contain an integer-overflow vulnerability","content_text":"VMware · VMware Workstation. Not in CISA KEV. EPSS 0.4% (higher than 35.1% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 21.2 of 100.","summary":"VMware Workstation and Fusion contain an integer-overflow vulnerability","date_published":"2026-10-07T00:00:00.000Z","date_modified":"2026-10-07T15:58:17.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":21.2,"kev":null,"epss":{"score":0.00408,"percentile":0.3507},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"VMware Workstation","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-59309","url":"https://patchfirst.co/cve/CVE-2026-59309/","title":"CVE-2026-59309: vCenter authentication-bypass vulnerability","content_text":"VMware · Cloud Foundation. Not in CISA KEV. EPSS 0.6% (higher than 49.2% of CVEs). CVSS 9.8 CRITICAL. Priority 64.7 of 100.","summary":"vCenter authentication-bypass vulnerability","date_published":"2026-07-30T00:00:00.000Z","date_modified":"2026-07-30T15:08:05.000Z","tags":[],"_patchfirst":{"reason":"published","priority":64.7,"kev":null,"epss":{"score":0.00611,"percentile":0.49206},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Cloud Foundation","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-22224#kev","url":"https://patchfirst.co/cve/CVE-2025-22224/","title":"[KEV] CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","content_text":"VMware · ESXi and Workstation. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1055 Process Injection; T1611 Escape to Host. Priority 68.8 of 100.","summary":"VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-06-17T08:45:43.000Z","tags":["kev","T1055","T1611"],"_patchfirst":{"reason":"kev","priority":68.8,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.01561,"percentile":0.75213},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi and Workstation","techniqueIds":["T1055","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-22226#kev","url":"https://patchfirst.co/cve/CVE-2025-22226/","title":"[KEV] CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","content_text":"VMware · ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.2% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1005 Data from Local System; T1611 Escape to Host. Priority 67.4 of 100.","summary":"VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-06-17T08:45:44.000Z","tags":["kev","T1005","T1611"],"_patchfirst":{"reason":"kev","priority":67.4,"kev":{"dateAdded":"2025-03-04","ransomware":false},"epss":{"score":0.01633,"percentile":0.7624},"cvss":{"score":6,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"ESXi, Workstation, and Fusion","techniqueIds":["T1005","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-22225#kev","url":"https://patchfirst.co/cve/CVE-2025-22225/","title":"[KEV] CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability","content_text":"VMware · ESXi. In CISA KEV since 2025-03-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.3% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 66.4 of 100.","summary":"VMware ESXi Arbitrary Write Vulnerability","date_published":"2025-03-04T00:00:00.000Z","date_modified":"2026-08-04T05:16:33.000Z","tags":["kev","ransomware","T1068","T1611"],"_patchfirst":{"reason":"kev","priority":66.4,"kev":{"dateAdded":"2025-03-04","ransomware":true},"epss":{"score":0.01016,"percentile":0.63283},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi","techniqueIds":["T1068","T1611"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-38812#kev","url":"https://patchfirst.co/cve/CVE-2024-38812/","title":"[KEV] CVE-2024-38812: VMware vCenter Server Heap-Based Buffer Overflow Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2024-11-20. ENISA EUVD lists it as exploited. EPSS 54.6% (higher than 99.02% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 64.7 of 100.","summary":"VMware vCenter Server Heap-Based Buffer Overflow Vulnerability","date_published":"2024-11-20T00:00:00.000Z","date_modified":"2026-06-17T07:41:05.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":64.7,"kev":{"dateAdded":"2024-11-20","ransomware":false},"epss":{"score":0.54571,"percentile":0.99016},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-38813#kev","url":"https://patchfirst.co/cve/CVE-2024-38813/","title":"[KEV] CVE-2024-38813: VMware vCenter Server Privilege Escalation Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2024-11-20. ENISA EUVD lists it as exploited. EPSS 17.4% (higher than 97.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 64.3 of 100.","summary":"VMware vCenter Server Privilege Escalation Vulnerability","date_published":"2024-11-20T00:00:00.000Z","date_modified":"2026-06-17T07:41:05.000Z","tags":["kev","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":64.3,"kev":{"dateAdded":"2024-11-20","ransomware":false},"epss":{"score":0.17355,"percentile":0.97112},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-37085#kev","url":"https://patchfirst.co/cve/CVE-2024-37085/","title":"[KEV] CVE-2024-37085: VMware ESXi Authentication Bypass Vulnerability","content_text":"VMware · ESXi. In CISA KEV since 2024-07-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 26.8% (higher than 98% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1608.001 Upload Malware. Priority 77.6 of 100.","summary":"VMware ESXi Authentication Bypass Vulnerability","date_published":"2024-07-30T00:00:00.000Z","date_modified":"2026-06-17T07:37:43.000Z","tags":["kev","ransomware","public-exploit","T1078","T1068","T1608.001"],"_patchfirst":{"reason":"kev","priority":77.6,"kev":{"dateAdded":"2024-07-30","ransomware":true},"epss":{"score":0.2677,"percentile":0.98028},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"ESXi","techniqueIds":["T1078","T1068","T1608.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22948#kev","url":"https://patchfirst.co/cve/CVE-2022-22948/","title":"[KEV] CVE-2022-22948: VMware vCenter Server Incorrect Default File Permissions Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2024-07-17. ENISA EUVD lists it as exploited. EPSS 13.3% (higher than 96.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access; T1068 Exploitation for Privilege Escalation. Named in 2 threat reports. Priority 73.0 of 100.","summary":"VMware vCenter Server Incorrect Default File Permissions Vulnerability","date_published":"2024-07-17T00:00:00.000Z","date_modified":"2026-06-17T04:29:13.000Z","tags":["kev","public-exploit","T1078","T1212","T1068"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2024-07-17","ransomware":false},"epss":{"score":0.13282,"percentile":0.96384},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1078","T1212","T1068"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-34048#kev","url":"https://patchfirst.co/cve/CVE-2023-34048/","title":"[KEV] CVE-2023-34048: VMware vCenter Server Out-of-Bounds Write Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2024-01-22. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1588.001 Malware. Named in 1 threat report. Priority 73.7 of 100.","summary":"VMware vCenter Server Out-of-Bounds Write Vulnerability","date_published":"2024-01-22T00:00:00.000Z","date_modified":"2026-06-17T06:02:47.000Z","tags":["kev","public-exploit","T1588.001"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2024-01-22","ransomware":false},"epss":{"score":0.99234,"percentile":0.99936},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1588.001"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-20867#kev","url":"https://patchfirst.co/cve/CVE-2023-20867/","title":"[KEV] CVE-2023-20867: VMware Tools Authentication Bypass Vulnerability","content_text":"VMware · Tools. In CISA KEV since 2023-06-23. ENISA EUVD lists it as exploited. EPSS 13.6% (higher than 96.5% of CVEs). CVSS 3.9 LOW. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Named in 2 threat reports. Priority 76.2 of 100.","summary":"VMware Tools Authentication Bypass Vulnerability","date_published":"2023-06-23T00:00:00.000Z","date_modified":"2026-06-17T05:31:03.000Z","tags":["kev","T1078","T1059","T1105"],"_patchfirst":{"reason":"kev","priority":76.2,"kev":{"dateAdded":"2023-06-23","ransomware":false},"epss":{"score":0.13638,"percentile":0.96477},"cvss":{"score":3.9,"severity":"LOW","version":"3.1"},"vendor":"VMware","product":"Tools","techniqueIds":["T1078","T1059","T1105"],"reportCount":2,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-20887#kev","url":"https://patchfirst.co/cve/CVE-2023-20887/","title":"[KEV] CVE-2023-20887: Vmware Aria Operations for Networks Command Injection Vulnerability","content_text":"VMware · Aria Operations for Networks. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Vmware Aria Operations for Networks Command Injection Vulnerability","date_published":"2023-06-22T00:00:00.000Z","date_modified":"2026-06-17T05:31:07.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2023-06-22","ransomware":false},"epss":{"score":0.98281,"percentile":0.99916},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Aria Operations for Networks","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22947#kev","url":"https://patchfirst.co/cve/CVE-2022-22947/","title":"[KEV] CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability","content_text":"VMware · Spring Cloud Gateway. In CISA KEV since 2022-05-16. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Priority 70.0 of 100.","summary":"VMware Spring Cloud Gateway Code Injection Vulnerability","date_published":"2022-05-16T00:00:00.000Z","date_modified":"2026-06-17T04:29:13.000Z","tags":["kev","public-exploit","T1190","T1059","T1486"],"_patchfirst":{"reason":"kev","priority":70,"kev":{"dateAdded":"2022-05-16","ransomware":false},"epss":{"score":0.98253,"percentile":0.99916},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Spring Cloud Gateway","techniqueIds":["T1190","T1059","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22960#kev","url":"https://patchfirst.co/cve/CVE-2022-22960/","title":"[KEV] CVE-2022-22960: VMware Multiple Products Privilege Escalation Vulnerability","content_text":"VMware · Multiple Products. In CISA KEV since 2022-04-15. ENISA EUVD lists it as exploited. EPSS 35.5% (higher than 98.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1222 File and Directory Permissions Modification. Priority 68.2 of 100.","summary":"VMware Multiple Products Privilege Escalation Vulnerability","date_published":"2022-04-15T00:00:00.000Z","date_modified":"2026-06-17T04:29:14.000Z","tags":["kev","public-exploit","T1222"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2022-04-15","ransomware":false},"epss":{"score":0.35519,"percentile":0.98451},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"Multiple Products","techniqueIds":["T1222"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22954#kev","url":"https://patchfirst.co/cve/CVE-2022-22954/","title":"[KEV] CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","content_text":"VMware · Workspace ONE Access and Identity Manager. In CISA KEV since 2022-04-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Priority 79.9 of 100.","summary":"VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","date_published":"2022-04-14T00:00:00.000Z","date_modified":"2026-06-17T04:29:14.000Z","tags":["kev","ransomware","public-exploit","T1505.003"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2022-04-14","ransomware":true},"epss":{"score":0.99998,"percentile":0.99989},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Workspace ONE Access and Identity Manager","techniqueIds":["T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-22965#kev","url":"https://patchfirst.co/cve/CVE-2022-22965/","title":"[KEV] CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability","content_text":"VMware · Spring Framework. In CISA KEV since 2022-04-04. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 2 threat reports. Priority 86.0 of 100.","summary":"Spring Framework JDK 9+ Remote Code Execution Vulnerability","date_published":"2022-04-04T00:00:00.000Z","date_modified":"2026-06-17T04:29:15.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":86,"kev":{"dateAdded":"2022-04-04","ransomware":false},"epss":{"score":0.99638,"percentile":0.9995},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Spring Framework","techniqueIds":["T1190","T1059"],"reportCount":2,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-6961#kev","url":"https://patchfirst.co/cve/CVE-2018-6961/","title":"[KEV] CVE-2018-6961: VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability","content_text":"VMware · SD-WAN Edge. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 85.3% (higher than 99.72% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.6 of 100.","summary":"VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T02:02:31.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":68.6,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.85342,"percentile":0.99717},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"SD-WAN Edge","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-21973#kev","url":"https://patchfirst.co/cve/CVE-2021-21973/","title":"[KEV] CVE-2021-21973: VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","content_text":"VMware · vCenter Server and Cloud Foundation. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 88.0% (higher than 99.76% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1046 Network Service Discovery. Priority 66.7 of 100.","summary":"VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability","date_published":"2022-03-07T00:00:00.000Z","date_modified":"2026-06-17T03:36:28.000Z","tags":["kev","public-exploit","T1190","T1046"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2022-03-07","ransomware":false},"epss":{"score":0.88012,"percentile":0.99764},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"vCenter Server and Cloud Foundation","techniqueIds":["T1190","T1046"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-21975#kev","url":"https://patchfirst.co/cve/CVE-2021-21975/","title":"[KEV] CVE-2021-21975: VMware Server Side Request Forgery in vRealize Operations Manager API","content_text":"VMware · vRealize Operations Manager API. In CISA KEV since 2022-01-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.0% (higher than 99.57% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 78.2 of 100.","summary":"VMware Server Side Request Forgery in vRealize Operations Manager API","date_published":"2022-01-18T00:00:00.000Z","date_modified":"2026-10-02T14:54:50.000Z","tags":["kev","ransomware","public-exploit","T1190"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2022-01-18","ransomware":true},"epss":{"score":0.78001,"percentile":0.99573},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"vRealize Operations Manager API","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22017#kev","url":"https://patchfirst.co/cve/CVE-2021-22017/","title":"[KEV] CVE-2021-22017: VMware vCenter Server Improper Access Control","content_text":"VMware · vCenter Server. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 49.2% (higher than 98.9% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090.001 Internal Proxy. Priority 66.5 of 100.","summary":"VMware vCenter Server Improper Access Control","date_published":"2022-01-10T00:00:00.000Z","date_modified":"2026-06-17T03:36:33.000Z","tags":["kev","public-exploit","T1190","T1090.001"],"_patchfirst":{"reason":"kev","priority":66.5,"kev":{"dateAdded":"2022-01-10","ransomware":false},"epss":{"score":0.49177,"percentile":0.98883},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1090.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-21972#kev","url":"https://patchfirst.co/cve/CVE-2021-21972/","title":"[KEV] CVE-2021-21972: VMware vCenter Server Remote Code Execution Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.","summary":"VMware vCenter Server Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:35.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99865,"percentile":0.99962},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22005#kev","url":"https://patchfirst.co/cve/CVE-2021-22005/","title":"[KEV] CVE-2021-22005: VMware vCenter Server File Upload Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"VMware vCenter Server File Upload Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:36:32.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99997},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-21985#kev","url":"https://patchfirst.co/cve/CVE-2021-21985/","title":"[KEV] CVE-2021-21985: VMware vCenter Server Improper Input Validation Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.","summary":"VMware vCenter Server Improper Input Validation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:36.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99992},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3992#kev","url":"https://patchfirst.co/cve/CVE-2020-3992/","title":"[KEV] CVE-2020-3992: VMware ESXi OpenSLP Use-After-Free Vulnerability","content_text":"VMware · ESXi. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 83.0% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services. Priority 79.8 of 100.","summary":"VMware ESXi OpenSLP Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:31.000Z","tags":["kev","ransomware","public-exploit","T1210"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.83015,"percentile":0.99673},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"ESXi","techniqueIds":["T1210"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-5544#kev","url":"https://patchfirst.co/cve/CVE-2019-5544/","title":"[KEV] CVE-2019-5544: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability","content_text":"VMware · VMware ESXi and Horizon DaaS. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 79.8 of 100.","summary":"VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:37:52.000Z","tags":["kev","ransomware","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.98129,"percentile":0.99913},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"VMware ESXi and Horizon DaaS","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3952#kev","url":"https://patchfirst.co/cve/CVE-2020-3952/","title":"[KEV] CVE-2020-3952: VMware vCenter Server Information Disclosure Vulnerability","content_text":"VMware · vCenter Server. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 90.4% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.","summary":"VMware vCenter Server Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:19:19.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.90384,"percentile":0.99799},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"vCenter Server","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-4006#kev","url":"https://patchfirst.co/cve/CVE-2020-4006/","title":"[KEV] CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability","content_text":"VMware · Multiple Products. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 17.3% (higher than 97.1% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 67.7 of 100.","summary":"Multiple VMware Products Command Injection Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:19:25.000Z","tags":["kev","T1190"],"_patchfirst":{"reason":"kev","priority":67.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.17302,"percentile":0.97104},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"VMware","product":"Multiple Products","techniqueIds":["T1190"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-3950#kev","url":"https://patchfirst.co/cve/CVE-2020-3950/","title":"[KEV] CVE-2020-3950: VMware Multiple Products Privilege Escalation Vulnerability","content_text":"VMware · Multiple Products. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.3% (higher than 94.3% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548.001 Setuid and Setgid. Priority 67.3 of 100.","summary":"VMware Multiple Products Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:19:18.000Z","tags":["kev","public-exploit","T1068","T1548.001"],"_patchfirst":{"reason":"kev","priority":67.3,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.07254,"percentile":0.94334},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"VMware","product":"Multiple Products","techniqueIds":["T1068","T1548.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-4946","url":"https://patchfirst.co/cve/CVE-2017-4946/","title":"CVE-2017-4946: The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability","content_text":"VMware · vRealize Operations for Horizon (V4H). Not in CISA KEV. EPSS 0.5% (higher than 43% of CVEs). Priority 44.7 of 100.","summary":"The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability","date_published":"2018-01-05T00:00:00.000Z","date_modified":"2024-09-16T16:13:08.000Z","tags":[],"_patchfirst":{"reason":"published","priority":44.7,"kev":null,"epss":{"score":0.00503,"percentile":0.4299},"cvss":null,"vendor":"VMware","product":"vRealize Operations for Horizon (V4H)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}