https://patchfirst.co/vendor/vmware/New and newly exploited VMware CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2026-59346/CVE-2026-59346Wed, 07 Oct 2026 00:00:00 GMTVMware · VMware Workstation. Not in CISA KEV. EPSS 0.4% (higher than 35.1% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 21.2 of 100.public-exploithttps://patchfirst.co/cve/CVE-2026-59309/CVE-2026-59309Thu, 30 Jul 2026 00:00:00 GMTVMware · Cloud Foundation. Not in CISA KEV. EPSS 0.6% (higher than 49.2% of CVEs). CVSS 9.8 CRITICAL. Priority 64.7 of 100.https://patchfirst.co/cve/CVE-2025-22224/CVE-2025-22224#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi and Workstation. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 75.2% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1055 Process Injection; T1611 Escape to Host. Priority 68.8 of 100.kevT1055T1611https://patchfirst.co/cve/CVE-2025-22226/CVE-2025-22226#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. ENISA EUVD lists it as exploited. EPSS 1.6% (higher than 76.2% of CVEs). CVSS 6.0 MEDIUM. ATT&CK: T1005 Data from Local System; T1611 Escape to Host. Priority 67.4 of 100.kevT1005T1611https://patchfirst.co/cve/CVE-2025-22225/CVE-2025-22225#kevTue, 04 Mar 2025 00:00:00 GMTVMware · ESXi. In CISA KEV since 2025-03-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.3% of CVEs). CVSS 8.2 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1611 Escape to Host. Priority 66.4 of 100.kevransomwareT1068T1611https://patchfirst.co/cve/CVE-2024-38812/CVE-2024-38812#kevWed, 20 Nov 2024 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2024-11-20. ENISA EUVD lists it as exploited. EPSS 54.6% (higher than 99.02% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 64.7 of 100.kevT1190T1059https://patchfirst.co/cve/CVE-2024-38813/CVE-2024-38813#kevWed, 20 Nov 2024 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2024-11-20. ENISA EUVD lists it as exploited. EPSS 17.4% (higher than 97.1% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 64.3 of 100.kevT1190T1068https://patchfirst.co/cve/CVE-2024-37085/CVE-2024-37085#kevTue, 30 Jul 2024 00:00:00 GMTVMware · ESXi. In CISA KEV since 2024-07-30, known ransomware use. ENISA EUVD lists it as exploited. EPSS 26.8% (higher than 98% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation; T1608.001 Upload Malware. Priority 77.6 of 100.kevransomwarepublic-exploitT1078T1068T1608.001https://patchfirst.co/cve/CVE-2022-22948/CVE-2022-22948#kevWed, 17 Jul 2024 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2024-07-17. ENISA EUVD lists it as exploited. EPSS 13.3% (higher than 96.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1212 Exploitation for Credential Access; T1068 Exploitation for Privilege Escalation. Named in 2 threat reports. Priority 73.0 of 100.kevpublic-exploitT1078T1212T1068https://patchfirst.co/cve/CVE-2023-34048/CVE-2023-34048#kevMon, 22 Jan 2024 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2024-01-22. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1588.001 Malware. Named in 1 threat report. Priority 73.7 of 100.kevpublic-exploitT1588.001https://patchfirst.co/cve/CVE-2023-20867/CVE-2023-20867#kevFri, 23 Jun 2023 00:00:00 GMTVMware · Tools. In CISA KEV since 2023-06-23. ENISA EUVD lists it as exploited. EPSS 13.6% (higher than 96.5% of CVEs). CVSS 3.9 LOW. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter; T1105 Ingress Tool Transfer. Named in 2 threat reports. Priority 76.2 of 100.kevT1078T1059T1105https://patchfirst.co/cve/CVE-2023-20887/CVE-2023-20887#kevThu, 22 Jun 2023 00:00:00 GMTVMware · Aria Operations for Networks. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-22947/CVE-2022-22947#kevMon, 16 May 2022 00:00:00 GMTVMware · Spring Cloud Gateway. In CISA KEV since 2022-05-16. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1486 Data Encrypted for Impact. Priority 70.0 of 100.kevpublic-exploitT1190T1059T1486https://patchfirst.co/cve/CVE-2022-22960/CVE-2022-22960#kevFri, 15 Apr 2022 00:00:00 GMTVMware · Multiple Products. In CISA KEV since 2022-04-15. ENISA EUVD lists it as exploited. EPSS 35.5% (higher than 98.5% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1222 File and Directory Permissions Modification. Priority 68.2 of 100.kevpublic-exploitT1222https://patchfirst.co/cve/CVE-2022-22954/CVE-2022-22954#kevThu, 14 Apr 2022 00:00:00 GMTVMware · Workspace ONE Access and Identity Manager. In CISA KEV since 2022-04-14, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1505.003 Web Shell. Priority 79.9 of 100.kevransomwarepublic-exploitT1505.003https://patchfirst.co/cve/CVE-2022-22965/CVE-2022-22965#kevMon, 04 Apr 2022 00:00:00 GMTVMware · Spring Framework. In CISA KEV since 2022-04-04. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 2 threat reports. Priority 86.0 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2018-6961/CVE-2018-6961#kevFri, 25 Mar 2022 00:00:00 GMTVMware · SD-WAN Edge. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 85.3% (higher than 99.72% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.6 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2021-21973/CVE-2021-21973#kevMon, 07 Mar 2022 00:00:00 GMTVMware · vCenter Server and Cloud Foundation. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 88.0% (higher than 99.76% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1046 Network Service Discovery. Priority 66.7 of 100.kevpublic-exploitT1190T1046https://patchfirst.co/cve/CVE-2021-21975/CVE-2021-21975#kevTue, 18 Jan 2022 00:00:00 GMTVMware · vRealize Operations Manager API. In CISA KEV since 2022-01-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 78.0% (higher than 99.57% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 78.2 of 100.kevransomwarepublic-exploitT1190https://patchfirst.co/cve/CVE-2021-22017/CVE-2021-22017#kevMon, 10 Jan 2022 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 49.2% (higher than 98.9% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1090.001 Internal Proxy. Priority 66.5 of 100.kevpublic-exploitT1190T1090.001https://patchfirst.co/cve/CVE-2021-21972/CVE-2021-21972#kevWed, 03 Nov 2021 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2021-22005/CVE-2021-22005#kevWed, 03 Nov 2021 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2021-21985/CVE-2021-21985#kevWed, 03 Nov 2021 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2020-3992/CVE-2020-3992#kevWed, 03 Nov 2021 00:00:00 GMTVMware · ESXi. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 83.0% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1210 Exploitation of Remote Services. Priority 79.8 of 100.kevransomwarepublic-exploitT1210https://patchfirst.co/cve/CVE-2019-5544/CVE-2019-5544#kevWed, 03 Nov 2021 00:00:00 GMTVMware · VMware ESXi and Horizon DaaS. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 79.8 of 100.kevransomwarepublic-exploitT1190T1499.004https://patchfirst.co/cve/CVE-2020-3952/CVE-2020-3952#kevWed, 03 Nov 2021 00:00:00 GMTVMware · vCenter Server. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 90.4% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2020-4006/CVE-2020-4006#kevWed, 03 Nov 2021 00:00:00 GMTVMware · Multiple Products. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 17.3% (higher than 97.1% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 67.7 of 100.kevT1190https://patchfirst.co/cve/CVE-2020-3950/CVE-2020-3950#kevWed, 03 Nov 2021 00:00:00 GMTVMware · Multiple Products. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.3% (higher than 94.3% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation; T1548.001 Setuid and Setgid. Priority 67.3 of 100.kevpublic-exploitT1068T1548.001https://patchfirst.co/cve/CVE-2017-4946/CVE-2017-4946Fri, 05 Jan 2018 00:00:00 GMTVMware · vRealize Operations for Horizon (V4H). Not in CISA KEV. EPSS 0.5% (higher than 43% of CVEs). Priority 44.7 of 100.