Skip to content
OpenAdvisories

Category

Virtualization

937 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Low 2.7
    CVE-2026-41709 Exploited

    ESX insufficient logging vulnerability

    VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

    VMware Cloud Foundation Telco Cloud Platform vSphere Foundation Virtualization
    KEV Oct 28, 2026
  • Critical 9.8
    CVE-2026-59310 Exploited · Ransomware Public exploit EPSS 62%

    vCenter directory-traversal vulnerability

    VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

    VMware Cloud Foundation Telco Cloud Platform Telco Cloud Infrastructure Virtualization
    KEV Aug 18, 2026
  • High 7.1
    CVE-2025-22226 Exploited

    VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HG…

    Virtualization
    KEV Mar 4, 2025
  • High 8.2
    CVE-2025-22225 Exploited · Ransomware

    VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may tri…

    Virtualization
    KEV Mar 4, 2025
  • Critical 9.3
    CVE-2025-22224 Exploited

    VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds …

    VMware Workstation ESXi Telco Cloud Platform Virtualization
    KEV Mar 4, 2025
  • High 7.5
    CVE-2024-38813 Exploited EPSS 17%

    Privilege escalation vulnerability

    The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

    Virtualization
    KEV Nov 20, 2024
  • Critical 9.8
    CVE-2024-38812 Exploited EPSS 55%

    Heap-overflow vulnerability

    The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to…

    Virtualization
    KEV Nov 20, 2024
  • Medium 6.8
    CVE-2024-37085 Exploited · Ransomware Public exploit EPSS 27%

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…

    Virtualization
    KEV Jul 30, 2024
  • Critical 9.8
    CVE-2024-37079 Exploited EPSS 22%

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor w…

    Virtualization
    KEV Jan 23, 2026
  • Critical 9.8
    CVE-2023-34048 Exploited EPSS 99%

    VMware vCenter Server Out-of-Bounds Write Vulnerability

    vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

    VMware VMware vCenter Server VMware Cloud Foundation (VMware vCenter Server) Virtualization
    KEV Jan 22, 2024
  • Medium 6.5
    CVE-2022-22948 Exploited Public exploit EPSS 13%

    The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…

    Virtualization
    KEV Jul 17, 2024
  • Medium 5.3
    CVE-2021-22017 Exploited EPSS 49%

    Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mal…

    Virtualization
    KEV Jan 10, 2022
  • Critical 9.8
    CVE-2021-22005 Exploited · Ransomware Public exploit EPSS 100%

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21985 Exploited · Ransomware Public exploit EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21972 Exploited · Ransomware Public exploit EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor…

    Virtualization
    KEV Nov 3, 2021
  • Medium 5.3
    CVE-2021-21973 Exploited Public exploit EPSS 88%

    The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…

    Virtualization
    KEV Mar 7, 2022
  • Critical 9.8
    CVE-2020-3992 Exploited · Ransomware Public exploit EPSS 83%

    OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3952 Exploited Public exploit EPSS 90%

    Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Serv…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-5544 Exploited · Ransomware Public exploit EPSS 98%

    OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity o…

    openslp-dfsg Virtualization Ubuntu
    KEV Nov 3, 2021