Patchfirst
Patchfirst

Vendor

VMware

26 of 29 VMware CVEs in Patchfirst (90%) are in of vulnerabilities exploited in the wild, 9 of them used by ransomware.

CVEs
29
In CISA KEV
2690%
Known ransomware use
9
Median days to KEV
82
from publication
Latest KEV listing
4 Mar 2025
Watch VMware Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • vCenter Server In KEV: 9 CVEs: 9
  • ESXi In KEV: 3 CVEs: 3
  • Multiple Products In KEV: 3 CVEs: 3
  • Aria Operations for Networks In KEV: 1 CVEs: 1
  • ESXi and Workstation In KEV: 1 CVEs: 1
  • ESXi, Workstation, and Fusion In KEV: 1 CVEs: 1
  • SD-WAN Edge In KEV: 1 CVEs: 1
  • Spring Cloud Gateway In KEV: 1 CVEs: 1
  • Spring Framework In KEV: 1 CVEs: 1
  • Tools In KEV: 1 CVEs: 1

Top ATT&CK techniques

What attackers do with VMware CVEs
Open in ATT&CK Navigator

Counts are VMware CVEs linked to the technique. Each link’s provenance is on the CVE page.

VMware CVEs

29 CVEs, by priority
  1. CVE-2022-22965Spring Framework JDK 9+ Remote Code Execution Vulnerability
    VMware · Spring FrameworkKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports
    99.6%Top 0.05%
    86.0priority
  2. CVE-2021-21972VMware vCenter Server Remote Code Execution Vulnerability
    VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    99.9%Top 0.04%
    83.7priority
  3. CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
    VMware · Workspace ONE Access and Identity ManagerKEVRansomwarePublic exploitCritical · 9.8T1505.003Web Shell
    >99.9%Top 0.01%
    79.9priority
  4. CVE-2021-22005VMware vCenter Server File Upload Vulnerability
    VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    >99.9%Top 0.01%
    79.9priority
  5. CVE-2021-21985VMware vCenter Server Improper Input Validation Vulnerability
    VMware · vCenter ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    >99.9%Top 0.01%
    79.9priority
  6. CVE-2020-3992VMware ESXi OpenSLP Use-After-Free Vulnerability
    VMware · ESXiKEVRansomwarePublic exploitCritical · 9.8T1210Exploitation of Remote Services
    83.0%Top 0.33%
    79.8priority
  7. CVE-2019-5544VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
    VMware · VMware ESXi and Horizon DaaSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation
    98.1%Top 0.09%
    79.8priority
  8. CVE-2021-21975VMware Server Side Request Forgery in vRealize Operations Manager API
    VMware · vRealize Operations Manager APIKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing Application
    78.0%Top 0.43%
    78.2priority
  9. CVE-2024-37085VMware ESXi Authentication Bypass Vulnerability
    VMware · ESXiKEVRansomwarePublic exploitHigh · 7.2T1608.001Upload MalwareT1078Valid Accounts+1 more
    26.8%Top 2%
    77.6priority
  10. CVE-2023-20867VMware Tools Authentication Bypass Vulnerability
    VMware · ToolsKEVLow · 3.9T1078Valid AccountsT1059Command and Scripting Interpreter+1 more · 2 reports
    13.6%Top 3.5%
    76.2priority
  11. CVE-2023-34048VMware vCenter Server Out-of-Bounds Write Vulnerability
    VMware · vCenter ServerKEVPublic exploitCritical · 9.8T1588.001Malware1 report
    99.2%Top 0.06%
    73.7priority
  12. CVE-2022-22948VMware vCenter Server Incorrect Default File Permissions Vulnerability
    VMware · vCenter ServerKEVPublic exploitMedium · 6.5T1078Valid AccountsT1068Exploitation for Privilege Escalation+1 more · 2 reports
    13.3%Top 3.6%
    73.0priority
  13. CVE-2022-22947VMware Spring Cloud Gateway Code Injection Vulnerability
    VMware · Spring Cloud GatewayKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    98.3%Top 0.08%
    70.0priority
  14. CVE-2023-20887Vmware Aria Operations for Networks Command Injection Vulnerability
    VMware · Aria Operations for NetworksKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    98.3%Top 0.08%
    69.8priority
  15. CVE-2020-3952VMware vCenter Server Information Disclosure Vulnerability
    VMware · vCenter ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts
    90.4%Top 0.2%
    69.8priority
  16. CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
    VMware · ESXi and WorkstationKEVHigh · 8.2T1055Process InjectionT1611Escape to Host
    1.6%Top 25%
    68.8priority
  17. CVE-2018-6961VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
    VMware · SD-WAN EdgeKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    85.3%Top 0.28%
    68.6priority
  18. CVE-2022-22960VMware Multiple Products Privilege Escalation Vulnerability
    VMware · Multiple ProductsKEVPublic exploitHigh · 7.8T1222File and Directory Permissions Modification
    35.5%Top 1.5%
    68.2priority
  19. CVE-2020-4006Multiple VMware Products Command Injection Vulnerability
    VMware · Multiple ProductsKEVCritical · 9.1T1190Exploit Public-Facing Application1 report
    17.3%Top 2.9%
    67.7priority
  20. CVE-2025-22226VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
    VMware · ESXi, Workstation, and FusionKEVMedium · 6.0T1611Escape to HostT1005Data from Local System
    1.6%Top 24%
    67.4priority
  21. CVE-2020-3950VMware Multiple Products Privilege Escalation Vulnerability
    VMware · Multiple ProductsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1548.001Setuid and Setgid
    7.3%Top 5.7%
    67.3priority
  22. CVE-2021-21973VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
    VMware · vCenter Server and Cloud FoundationKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1046Network Service Discovery
    88.0%Top 0.24%
    66.7priority
  23. CVE-2021-22017VMware vCenter Server Improper Access Control
    VMware · vCenter ServerKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1090.001Internal Proxy
    49.2%Top 1.1%
    66.5priority
  24. CVE-2025-22225VMware ESXi Arbitrary Write Vulnerability
    VMware · ESXiKEVRansomwareHigh · 8.2T1068Exploitation for Privilege EscalationT1611Escape to Host
    1.0%Top 37%
    66.4priority
  25. CVE-2026-59309vCenter authentication-bypass vulnerability
    VMware · Cloud FoundationCritical · 9.8
    0.6%Top 51%
    64.7priority
  26. CVE-2024-38812VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
    VMware · vCenter ServerKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    54.6%Top 0.98%
    64.7priority
  27. CVE-2024-38813VMware vCenter Server Privilege Escalation Vulnerability
    VMware · vCenter ServerKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1068Exploitation for Privilege Escalation
    17.4%Top 2.9%
    64.3priority
  28. CVE-2017-4946The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability
    VMware · vRealize Operations for Horizon (V4H)
    0.5%Top 57%
    44.7priority
  29. CVE-2026-59346VMware Workstation and Fusion contain an integer-overflow vulnerability
    VMware · VMware WorkstationPublic exploitCritical · 9.3
    0.4%Top 65%
    21.2priority
↑ ↓ chooseEnter openEsc close