Vmware
Vmware Cloud Foundation: vulnerabilities and CVEs
Vmware Cloud Foundation has 139 published vulnerabilities, 6 of them in the last 12 months. 17 are rated critical and 19 are listed by CISA as actively exploited.
CVEs139
Last 12 months6
Critical17
Actively exploited19
All vulnerabilities in the catalogue →⭐ Follow this technology
🔴 Actively exploited (CISA KEV)
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-22719 | High (8.1) | 18% | ⚠ Active exploitation | Feb 25, 2026 | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations… |
| CVE-2024-37079 | Critical (9.8) | 22% | ⚠ Active exploitation | Jun 18, 2024 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted… |
| CVE-2025-41244 | High (7.8) | 8.4% | ⚠ Active exploitation | Sep 29, 2025 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by… |
| CVE-2025-22226 | Medium (6) | 1.8% | ⚠ Active exploitation | Mar 4, 2025 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit… |
| CVE-2025-22224 | High (8.2) | 1.6% | ⚠ Active exploitation | Mar 4, 2025 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this… |
| CVE-2025-22225 | High (8.2) | 1.0% | ⚠ Active exploitation | Mar 4, 2025 | VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. |
| CVE-2024-38812 | Critical (9.8) | 55% | ⚠ Active exploitation | Sep 17, 2024 | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially… |
| CVE-2024-38813 | Critical (9.8) | 17% | ⚠ Active exploitation | Sep 17, 2024 | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted… |
| CVE-2024-37085 | High (7.2) | 27% | ⚠ Active exploitation | Jun 25, 2024 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user… |
| CVE-2022-22948 | Medium (6.5) | 13% | ⚠ Active exploitation | Mar 29, 2022 | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to… |
| CVE-2022-22960 | High (7.8) | 36% | ⚠ Active exploitation | Apr 13, 2022 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate… |
| CVE-2022-22954 | Critical (9.8) | 100% | ⚠ Active exploitation | Apr 11, 2022 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection… |
| CVE-2021-21973 | Medium (5.3) | 88% | ⚠ Active exploitation | Feb 24, 2021 | The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this… |
| CVE-2021-21975 | High (7.5) | 78% | ⚠ Active exploitation | Mar 31, 2021 | Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request… |
| CVE-2021-21985 | Critical (9.8) | 100% | ⚠ Active exploitation | May 26, 2021 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with… |
| CVE-2020-3992 | Critical (9.8) | 83% | ⚠ Active exploitation | Oct 20, 2020 | OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who… |
| CVE-2020-4006 | Critical (9.1) | 17% | ⚠ Active exploitation | Nov 23, 2020 | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. |
| CVE-2021-21972 | Critical (9.8) | 100% | ⚠ Active exploitation | Feb 24, 2021 | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted… |
| CVE-2021-22005 | Critical (9.8) | 100% | ⚠ Active exploitation | Sep 23, 2021 | The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server… |
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-41724 | Medium (5.4) | 0.32% | — | Jun 8, 2026 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform… |
| CVE-2026-41723 | High (8) | 0.42% | — | Jun 8, 2026 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform… |
| CVE-2026-41722 | Medium (5.4) | 0.32% | — | Jun 8, 2026 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform… |
| CVE-2026-22721 | High (7.2) | 0.71% | — | Feb 25, 2026 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria… |
| CVE-2026-22720 | Critical (9) | 0.42% | — | Feb 25, 2026 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria… |
| CVE-2026-22719 | High (8.1) | 18% | ⚠ Active exploitation | Feb 25, 2026 | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations… |
| CVE-2025-41252 | High (7.5) | 0.69% | — | Sep 29, 2025 | Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact:… |
| CVE-2025-41251 | High (8.1) | 0.80% | — | Sep 29, 2025 | VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username… |
| CVE-2025-41244 | High (7.8) | 8.4% | ⚠ Active exploitation | Sep 29, 2025 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by… |
| CVE-2025-22245 | Medium (5.9) | 0.26% | — | Jun 4, 2025 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation. |
| CVE-2025-22244 | Medium (6.9) | 0.31% | — | Jun 4, 2025 | VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation. |
| CVE-2025-22243 | High (7.5) | 0.34% | — | Jun 4, 2025 | VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation. |
| CVE-2025-41231 | High (7.3) | 0.17% | — | May 20, 2025 | VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive… |
| CVE-2025-41230 | High (7.5) | 0.43% | — | May 20, 2025 | VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information. |
| CVE-2025-41229 | High (8.2) | 0.67% | — | May 20, 2025 | VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services. |
| CVE-2025-22249 | High (8.2) | 0.34% | — | May 13, 2025 | VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by… |
| CVE-2025-22226 | Medium (6) | 1.8% | ⚠ Active exploitation | Mar 4, 2025 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit… |
| CVE-2025-22225 | High (8.2) | 1.0% | ⚠ Active exploitation | Mar 4, 2025 | VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. |
| CVE-2025-22224 | High (8.2) | 1.6% | ⚠ Active exploitation | Mar 4, 2025 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this… |
| CVE-2025-22222 | Medium (6.5) | 0.56% | — | Jan 30, 2025 | VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid… |
| CVE-2025-22221 | Medium (4.8) | 0.40% | — | Jan 30, 2025 | VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject a malicious script that could be… |
| CVE-2025-22220 | Medium (5.4) | 0.33% | — | Jan 30, 2025 | VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria Operations for Logs API may be able to perform certain… |
| CVE-2025-22219 | Critical (9) | 0.67% | — | Jan 30, 2025 | VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that (can perform stored cross-site… |
| CVE-2025-22218 | High (7.7) | 0.68% | — | Jan 30, 2025 | VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria… |
| CVE-2024-38834 | Medium (4.8) | 0.31% | — | Nov 26, 2024 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the… |
| CVE-2024-38833 | Medium (5.4) | 0.40% | — | Nov 26, 2024 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product… |
| CVE-2024-38832 | Medium (6.4) | 0.44% | — | Nov 26, 2024 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product… |
| CVE-2024-38831 | High (7.8) | 0.29% | — | Nov 26, 2024 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root… |
| CVE-2024-38830 | High (7.8) | 0.18% | — | Nov 26, 2024 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance… |
| CVE-2024-38813 | Critical (9.8) | 17% | ⚠ Active exploitation | Sep 17, 2024 | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted… |