VMware vulnerabilities

CVEs per yearBy the year they were published

1. 20171
2. 201826
3. 201853
4. 202022
5. 202022
6. 20222
7. 202312
8. 202417
9. 202547
10. 202639

Known exploitedNewest addition to KEV first

• CVE-2026-41709

  ESX insufficient logging vulnerability

  VMware · Cloud Foundation

  ExploitedLow2.7
• CVE-2026-59310

  vCenter directory-traversal vulnerability

  VMware · Cloud Foundation

  ExploitedCritical9.8
• CVE-2026-22719

  VMware Aria Operations command injection vulnerability

  VMware · VMware Aria Operations

  ExploitedHigh8.1
• CVE-2025-41244

  VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

  VMware · VCF operations

  ExploitedHigh7.8
• CVE-2025-22224

  VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…

  VMware · ESXi

  ExploitedCritical9.3
• CVE-2023-34048

  VMware vCenter Server Out-of-Bounds Write Vulnerability

  VMware · VMware vCenter Server

  ExploitedCritical9.8
• CVE-2023-20867

  VMware Tools Authentication Bypass Vulnerability

  VMware · VMware Tools

  ExploitedLow3.9
• CVE-2018-6961

  VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled…

  VMware · NSX SD-WAN by VeloCloud

  ExploitedHigh8.1

Newest CVEs

• CVE-2026-59347

  VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability

  VMware · VMware Workstation

  High8.1
• CVE-2026-59346

  VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

  VMware · VMware Workstation

  Critical9.3
• CVE-2026-59355

  Spring Authorization Server: Open Redirect via request_uri parameter

  VMware · Spring Authorization Server

  Medium6.1
• CVE-2026-41709

  ESX insufficient logging vulnerability

  VMware · Cloud Foundation

  ExploitedLow2.7
• CVE-2026-41703

  Out-of-bounds read vulnerability

  VMware · Cloud Foundation

  High7.6
• CVE-2026-47876

  VMXNET3 out-of-bounds write vulnerability

  VMware · Cloud Foundation

  Critical9.3
• CVE-2026-59309

  vCenter authentication-bypass vulnerability

  VMware · Cloud Foundation

  Critical9.8
• CVE-2026-59310

  vCenter directory-traversal vulnerability

  VMware · Cloud Foundation

  ExploitedCritical9.8
• CVE-2026-47871

  VMware Avi Load Balancer Directory Traversal Vulnerability

  VMware · Avi Load Balancer

  High8.8
• CVE-2026-47870

  VMware Avi Load Balancer Privilege Escalation Vulnerability

  VMware · Avi Load Balancer

  High7.1