VMware vulnerabilities
We track 175 vulnerabilities in VMware products across 60+ products. 168 are rated high or critical, and 34 have been exploited in real attacks. The most recent was published on October 7, 2026.
Latest VMware vulnerabilities
- 9.3 Critical severity
Cloud Foundation: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to exec
- 9.3 Critical severity
ESXi: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to ex
- 8.1 High severity
SALT: Improper Authorization
Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
- 8.1 High severity
SALT: Improper Authentication
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
- 8.8 High severity
vCenter Server: Improper Neutralization of Special Elements used in an OS Command
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.
- 7.3 High severity
VMware Cloud Foundation: Missing Authorization
VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.
- 7.5 High severity
Cloud Foundation: Exposure of Sensitive Information to an Unauthorized Actor
VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to gain access to sensitive information.
- 8.2 High severity
Cloud Foundation: Improper Limitation of a Pathname to a Restricted Directory
VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services.
- 7.5 High severity
Bitnami: Initialization of a Resource with an Insecure Default
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself use
- 8.2 High severity
Vmware Aria Automation: Improper Neutralization of Input During Web Page Generation
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious craf
- 7.8 High severity
VMware Aria operations: Improper Privilege Management
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privileges to root on the appliance running VMware Aria Operations.
- 6.0 Medium severity
VMware ESXi, Workstation, and Fusion Information Disclosure Exploited
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx proce
- 8.2 High severity
VMware ESXi Arbitrary Write Exploited
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
- 8.2 High severity
VMware ESXi and Workstation TOCTOU Race Condition Exploited
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual mach
- 9.0 Critical severity
VMware Aria Operations for Logs: Improper Neutralization of Input During Web Page Generation
VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that (can perform stored cross-site scripting) may lead to arbitrary operations
- 7.7 High severity
VMware Aria Operations for Logs: Generation of Error Message Containing Sensitive Information
VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria Operations for Logs
- 7.8 High severity
VMware Aria Operations: Improper Neutralization of Special Elements used in a Command
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria
- 7.8 High severity
VMware Aria Operations: Improper Privilege Management
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations.
- 8.8 High severity
VMware HCX: Improper Neutralization of Special Elements used in an SQL Command
An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on t
- 9.8 Critical severity
VMware vCenter Server Privilege Escalation Exploited
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- 9.8 Critical severity
VMware vCenter Server Heap-Based Buffer Overflow Exploited
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to
- 7.8 High severity
VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of…
VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion applicati
- 8.8 High severity
Spring Cloud Data Flow: Improper Control of Generation of Code
In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
- 8.1 High severity
VMware Aria Automation: Improper Neutralization of Special Elements used in an SQL Command
VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
- 8.2 High severity
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an…
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the fo
- 7.7 High severity
Salt Project: Improper Limitation of a Pathname to a Restricted Directory
A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.
- 7.2 High severity
VMware ESXi Authentication Bypass Exploited
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/
- 7.8 High severity
VMware vCenter Server: ASP.NET Misconfiguration: Use of Identity Impersonation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with non-administrative privileges may exploit these issues to elevate privileges to root on vCenter Server Appliance.
- 9.8 Critical severity
VMware vCenter Server: Out-of-bounds Write
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remo
- 9.8 Critical severity
Broadcom VMware vCenter Server Out-of-bounds Write Exploited
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remo
- 7.2 High severity
VMware vCenter Server: Improper Control of Generation of Code
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system.
- 7.8 High severity
VMware ESXi: Out-of-bounds Read
The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may exploit this issue to create a denial of service condition or e
- 8.2 High severity
VMware Workstation: Use After Free
VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on th
- 7.2 High severity
VMware Avi Load Balancer: Improper Privilege Management
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer can create, modify, execute and delete files as a root user on the host system.
- 8.1 High severity
Spring Framework: URL Redirection to Untrusted Site
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html att
- 7.4 High severity
VMware SD-WAN Edge: Improper Neutralization of Special Elements used in a Command
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local access to the Edge Router UI during activation may be able to perform a command injection attack that coul
- 8.1 High severity
Spring Framework: URL Redirection to Untrusted Site
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/defi
- 7.1 High severity
VMware ESXi: Allocation of Resources Without Limits or Throttling
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
- 8.2 High severity
VMware ESXi: Out-of-bounds Write
VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
- 8.1 High severity
Spring Framework: URL Redirection to Untrusted Site
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html att