VMware vulnerabilities
We track 175 vulnerabilities in VMware products across 60+ products. 168 are rated high or critical, and 34 have been exploited in real attacks. The most recent was published on October 7, 2026.
Latest VMware vulnerabilities
- 7.8 High severity
VMware Enhanced Authentication Plug-in (EAP): Session Fixation
Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the s
- 9.6 Critical severity
VMware Enhanced Authentication Plug-in (EAP): Improper Authentication
Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and rel
- 7.4 High severity
Spring Security: Improper Access Control
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method. Specifically, an appli
- 7.8 High severity
VMware Aria Operations for Networks: Improper Privilege Management
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain regular shell access.
- 7.8 High severity
VMware Aria Operations for Networks: Improper Privilege Management
Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain root access to the system.
- 8.3 High severity
VMware Aria Automation, VMware Cloud Foundation: Missing Authorization
Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.
- 9.8 Critical severity
VMware Cloud Director Appliance (VCD Appliance): Missing Authentication for Critical Functionality
VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network a
- 7.5 High severity
VMware Tools: Improper Verification of Cryptographic Signature
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virt
- 7.8 High severity
VMware Tools: Improper Privilege Management
VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges within the virtual machine.
- 9.8 Critical severity
VMware vCenter Server Out-of-Bounds Write Exploited
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
- 7.8 High severity
Fusion: Improper Privilege Management
VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade. A malici
- 7.0 High severity
Fusion: Time-of-check Time-of-use (TOCTOU) Race Condition
VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade.
- 7.8 High severity
VMware Aria Operations for Logs: Deserialization of Untrusted Data
VMware Aria Operations for Logs contains a deserialization vulnerability. A malicious actor with non-administrative access to the local system can trigger the deserialization of data which could result in authentication bypass.
- 9.8 Critical severity
VMware Aria Operations for Logs: Incorrect Authorization
VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
- 7.5 High severity
VMware Tools: Authentication Bypass by Capture-replay
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target
- 7.5 High severity
VMware SD-WAN (Edge): Missing Authorization
VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
- 7.5 High severity
VMware vCenter Server (vCenter Server): Out-of-bounds Read
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to deni
- 9.8 Critical severity
VMware vCenter Server (vCenter Server): Out-of-bounds Write
The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
- 9.8 Critical severity
VMware vCenter Server (vCenter Server): Out-of-bounds Write
The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to mem
- 9.8 Critical severity
VMware vCenter Server (vCenter Server): Use After Free
The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hos
- 9.8 Critical severity
VMware vCenter Server (vCenter Server): Out-of-bounds Write
The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrar
- 3.9 Low severity
VMware Tools Authentication Bypass Exploited
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
- 7.5 High severity
Aria Operations for Networks (Formerly…: Improper Neutralization of Special Elements used in a Command
Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in information disclosure.
- 8.8 High severity
Aria Operations for Networks (Formerly…: Deserialization of Untrusted Data
Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in
- 9.8 Critical severity
Vmware Aria Operations for Networks Command Injection Exploited
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
- 9.1 Critical severity
gpdb: Improper Limitation of a Pathname to a Restricted Directory
Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file wri
- 7.2 High severity
VMware Aria Operations (formerly vRealize…: Deserialization of Untrusted Data
VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt the system.
- 8.8 High severity
VMware Aria Operations (formerly vRealize…: Incorrect Authorization
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution leading to privilege escalation.
- 8.2 High severity
VMware Workstation Pro / Player (Workstation)…: Out-of-bounds Write
VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
- 7.8 High severity
VMware Fusion: Incorrect Authorization
VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host operating system can elevate privileges to gain root access to the host operating system.
- 7.5 High severity
Service Location Protocol (SLP) Denial-of-Service Exploited
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
- 7.2 High severity
VMware Aria Operations for Logs (formerly…: Improper Neutralization of Special Elements used in a Command
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
- 9.8 Critical severity
VMware Aria Operations for Logs (formerly…: Deserialization of Untrusted Data
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root.
- 7.2 High severity
VMware Carbon Black App Control: Improper Neutralization of Special Elements in Output Used by a Downstream Component
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted inp
- 8.8 High severity
VMware vRealize Orchestrator, VMware vRealize…: Improper Restriction of XML External Entity Reference
VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sen
- 8.4 High severity
VMware Workstation: Improper Privilege Management
VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is inst
- 8.8 High severity
VMware vRealize Operations (vROps): Cross-Site Request Forgery
VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user.
- 7.5 High severity
vRealize Log Insight (vRLI): Deserialization of Untrusted Data
vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.
- 9.8 Critical severity
vRealize Log Insight (vRLI): Improper Limitation of a Pathname to a Restricted Directory
The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
- 9.8 Critical severity
vRealize Log Insight (vRLI): Improper Access Control
The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.