Cloud Foundation vulnerabilities
60 known vulnerabilities in Cloud Foundation from VMware. 56 are rated high or critical, and 22 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 2.7 Low severity
Broadcom VMWare ESX Insufficient Logging Exploited
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
- 9.8 Critical severity
Broadcom VMware vCenter Path Traversal Exploited
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
- 9.8 Critical severity
Cloud Foundation: Incorrect Implementation of Authentication Algorithm
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
- 9.3 Critical severity
Cloud Foundation: Out-of-bounds Write
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host
- 7.6 High severity
Cloud Foundation: Out-of-bounds Read
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) conditi
- 8.0 High severity
VCF operations: Improper Neutralization of Input During Web Page Generation
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundat
- 7.2 High severity
VMware Aria Operations: Improper Privilege Management
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721,
- 9.0 Critical severity
VMware Aria Operations: Improper Neutralization of Input During Web Page Generation
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, ap
- 8.1 High severity
Broadcom VMware Aria Operations Command Injection Exploited
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration
- 8.5 High severity
vCenter: Improper Neutralization of Special Elements used in a Command
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
- 7.8 High severity
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Exploited
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploi
- 7.1 High severity
ESXi: Use of Uninitialized Resource
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this
- 9.3 Critical severity
ESXi: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue
- 9.3 Critical severity
Cloud Foundation: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to exec
- 9.3 Critical severity
ESXi: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to ex
- 8.8 High severity
vCenter Server: Improper Neutralization of Special Elements used in an OS Command
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.
- 7.3 High severity
VMware Cloud Foundation: Missing Authorization
VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.
- 7.5 High severity
Cloud Foundation: Exposure of Sensitive Information to an Unauthorized Actor
VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information.
- 8.2 High severity
Cloud Foundation: Improper Limitation of a Pathname to a Restricted Directory
VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.
- 8.2 High severity
Vmware Aria Automation: Improper Neutralization of Input During Web Page Generation
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious craf
- 6.0 Medium severity
VMware ESXi, Workstation, and Fusion Information Disclosure Exploited
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx proce
- 8.2 High severity
VMware ESXi Arbitrary Write Exploited
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
- 8.2 High severity
VMware ESXi and Workstation TOCTOU Race Condition Exploited
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual mach
- 9.0 Critical severity
VMware Aria Operations for Logs: Improper Neutralization of Input During Web Page Generation
VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that (can perform stored cross-site scripting) may lead to arbitrary operations
- 7.7 High severity
VMware Aria Operations for Logs: Generation of Error Message Containing Sensitive Information
VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs
- 7.8 High severity
VMware Aria Operations: Improper Neutralization of Special Elements used in a Command
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria
- 7.8 High severity
VMware Aria Operations: Improper Privilege Management
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations.
- 9.8 Critical severity
VMware vCenter Server Privilege Escalation Exploited
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- 9.8 Critical severity
VMware vCenter Server Heap-Based Buffer Overflow Exploited
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to
- 8.1 High severity
VMware Aria Automation: Improper Neutralization of Special Elements used in an SQL Command
VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
- 7.2 High severity
VMware ESXi Authentication Bypass Exploited
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/
- 7.8 High severity
VMware vCenter Server: ASP.NET Misconfiguration: Use of Identity Impersonation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
- 9.8 Critical severity
VMware vCenter Server: Out-of-bounds Write
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remo
- 9.8 Critical severity
Broadcom VMware vCenter Server Out-of-bounds Write Exploited
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remo
- 7.2 High severity
VMware vCenter Server: Improper Control of Generation of Code
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
- 7.8 High severity
VMware ESXi: Out-of-bounds Read
The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or e
- 7.1 High severity
VMware ESXi: Allocation of Resources Without Limits or Throttling
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
- 8.2 High severity
VMware ESXi: Out-of-bounds Write
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
- 8.3 High severity
VMware Aria Automation, VMware Cloud Foundation: Missing Authorization
Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.
- 9.8 Critical severity
VMware vCenter Server Out-of-Bounds Write Exploited
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.