VMware ESXi vulnerabilities

CVEs per yearBy the year they were published

1. 20179
2. 20183
3. 20194
4. 20201
5. 20258

Known exploitedNewest addition to KEV first

• CVE-2025-22224

  VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…

  VMware · ESXi

  ExploitedCritical9.3

Newest CVEs

• CVE-2025-41239

  vSockets information-disclosure vulnerability

  VMware · ESXi

  High7.1
• CVE-2025-41238

  PVSCSI heap-overflow vulnerability

  VMware · ESXi

  Critical9.3
• CVE-2025-41237

  VMCI integer-underflow vulnerability

  VMware · Cloud Foundation

  Critical9.3
• CVE-2025-41236

  VMXNET3 integer-overflow vulnerability

  VMware · ESXi

  Critical9.3
• CVE-2025-41228

  VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability

  VMware · vCenter Server

  Medium4.3
• CVE-2025-41227

  Denial-of-Service Vulnerability

  VMware · ESXi

  Medium5.5
• CVE-2025-41226

  Guest Operations Denial-of-Service Vulnerability

  VMware · ESXi

  Medium6.8
• CVE-2025-22224

  VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…

  VMware · ESXi

  ExploitedCritical9.3
• CVE-2020-3955

  ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual…

  VMware · ESXi

  Critical9.3
• CVE-2019-5528

  VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. Patch ESXi650-201907201-UG for this issue is available.

  VMware · ESXi

  Medium5.3