VMware vulnerabilities
We track 175 vulnerabilities in VMware products across 60+ products. 168 are rated high or critical, and 34 have been exploited in real attacks. The most recent was published on October 7, 2026.
Latest VMware vulnerabilities
- 8.1 High severity
VMware Workstation: Stack-based Buffer Overflow
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the ho
- 9.3 Critical severity
VMware Workstation: Integer Overflow or Wraparound
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - V
- 8.8 High severity
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when…
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the regist
- 2.7 Low severity
Broadcom VMWare ESX Insufficient Logging Exploited
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
- 9.8 Critical severity
Broadcom VMware vCenter Path Traversal Exploited
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
- 9.8 Critical severity
Cloud Foundation: Incorrect Implementation of Authentication Algorithm
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
- 9.3 Critical severity
Cloud Foundation: Out-of-bounds Write
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host
- 7.6 High severity
Cloud Foundation: Out-of-bounds Read
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) conditi
- 8.8 High severity
Avi Load Balancer: Improper Limitation of a Pathname to a Restricted Directory
VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed i
- 8.8 High severity
Avi Load Balancer: Improper Privilege Management
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 throug
- 8.8 High severity
Avi Load Balancer: Improper Control of Generation of Code
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 t
- 7.8 High severity
Avi Load Balancer: Improper Privilege Management
VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p
- 8.8 High severity
Avi Load Balancer: Improper Control of Generation of Code
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.
- 8.3 High severity
Avi Load Balancer: Incorrect Authorization
VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixe
- 9.8 Critical severity
Avi Load Balancer: Improper Authentication
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
- 8.0 High severity
VCF operations: Improper Neutralization of Input During Web Page Generation
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundat
- 7.0 High severity
Fusion: Time-of-check Time-of-use (TOCTOU) Race Condition
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to roo
- 8.2 High severity
Spring AI: Improper Neutralization of Special Elements Used in a Template Engine
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across con
- 7.5 High severity
Spring AI: Incorrect Default Permissions
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
- 7.5 High severity
Spring Cloud Gateway: External Control of System or Configuration Setting
When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support
- 8.6 High severity
Spring Cloud: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.
- 8.1 High severity
Spring Security: Authentication Bypass Using an Alternate Path or Channel
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Sec
- 9.1 Critical severity
Spring Security: Direct Request
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Hea
- 8.8 High severity
Spring AI: Improper Neutralization of Special Elements used in an SQL Command
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
- 8.6 High severity
Spring AI: Improper Neutralization of Special Elements used in an Expression Language Statement
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated
- 7.2 High severity
VMware Aria Operations: Improper Privilege Management
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721,
- 9.0 Critical severity
VMware Aria Operations: Improper Neutralization of Input During Web Page Generation
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, ap
- 8.1 High severity
Broadcom VMware Aria Operations Command Injection Exploited
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration
- 8.2 High severity
Spring Data Geode: Relative Path Traversal
A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.
- 7.5 High severity
Spring Cloud Gateway Server Webflux: Improper Neutralization of Special Elements used in an Expression Language Statement
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application
- 7.5 High severity
NSX: Observable Discrepancy
Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact: Username enumeration → facilitates unauthorize
- 8.1 High severity
NSX: Weak Password Recovery Mechanism for Forgotten Password
VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack
- 8.5 High severity
vCenter: Improper Neutralization of Special Elements used in a Command
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
- 7.8 High severity
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Exploited
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploi
- 7.6 High severity
Tools: Incorrect Authorization
VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this i
- 7.5 High severity
Spring Framework: Improper Authorization
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.
- 7.5 High severity
Spring Security: Authentication Bypass by Alternate Name
The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotat
- 10.0 Critical severity
bitnamicharts/appsmith: Files or Directories Accessible to External Parties
Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In affected versions, this can lead to unauthenticated access to sensitive credentials via HTTP/S. A remot
- 7.1 High severity
ESXi: Use of Uninitialized Resource
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this
- 9.3 Critical severity
ESXi: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue