VMware vulnerabilities
We track 175 vulnerabilities in VMware products across 60+ products. 168 are rated high or critical, and 34 have been exploited in real attacks. The most recent was published on October 7, 2026.
Latest VMware vulnerabilities
- 7.5 High severity
Apache Shiro: Interpretation Conflict
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro a
- 7.2 High severity
VMware vRealize Operations (vROps): Improper Privilege Management
vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
- 8.2 High severity
VMware ESXi, VMware Workstation Pro / Player…: Out-of-bounds Write
VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's
- 7.5 High severity
vRealize Log Insight (vRLI): Improper Limitation of a Pathname to a Restricted Directory
The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
- 9.8 Critical severity
VMware vRealize Network Insight (vRNI): Improper Neutralization of Special Elements used in a Command
vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication.
- 8.8 High severity
VMware ESXi, VMware Cloud Foundation: Out-of-bounds Write
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
- 9.9 Critical severity
Hyperic Agent: Deserialization of Untrusted Data
A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with
- 9.8 Critical severity
Hyperic Server: Missing Authorization
A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentication requirements when issuing requests to Hyperic Server. NOTE: This vulnerability only affects pro
- 10.0 Critical severity
Hyperic Server: Deserialization of Untrusted Data
A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the pr
- 9.8 Critical severity
VMware Workspace ONE Assist: Session Fixation
VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
- 9.8 Critical severity
VMware Workspace ONE Assist: Improper Access Control
VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- 9.8 Critical severity
VMware Workspace ONE Assist: Improper Authentication
VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- 9.8 Critical severity
VMware Workspace ONE Assist: Improper Authentication
VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- 9.8 Critical severity
Spring by VMware: Improper Control of Generation of Code
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing supp
- 9.8 Critical severity
Spring by VMware: Authorization Bypass Through User-Controlled Key
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expec
- 9.1 Critical severity
VMware Cloud Foundation (NSX-V): Improper Restriction of XML External Entity Reference
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
- 9.1 Critical severity
VMware vCenter Server: Deserialization of Untrusted Data
The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts
- 7.5 High severity
rabbitmq-server: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This mean
- 7.8 High severity
VMware Tools: Improper Privilege Management
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.
- 8.8 High severity
VMware vRealize Operations: Exposure of Sensitive Information to an Unauthorized Actor
VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create and leak hex dumps, leading to information disclosure. Successful exploitation can lead to a remote code execution.
- 7.2 High severity
VMware vRealize Operations: Improper Privilege Management
VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.
- 7.2 High severity
VMware Workspace ONE Access, Identity Manager…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
- 7.5 High severity
VMware Workspace ONE Access, Access Connector…: Improper Limitation of a Pathname to a Restricted Directory
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access may be able to access arbitrary files.
- 7.2 High severity
VMware Workspace ONE Access, Identity Manager…: Improper Neutralization of Special Elements used in an SQL Command
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
- 7.2 High severity
VMware Workspace ONE Access, Identity Manager…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
- 9.8 Critical severity
VMware Workspace ONE Access, Identity Manager…: URL Redirection to Untrusted Site
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.
- 7.5 High severity
VMware vCenter Server: Server-Side Request Forgery
The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service.
- 7.1 High severity
VMware Tools for Windows: Improper Restriction of XML External Entity Reference
VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to
- 7.8 High severity
VMware Multiple Products Privilege Escalation Exploited
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
- 7.2 High severity
VMware Workspace ONE Access, Identity Manager…: Deserialization of Untrusted Data
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malici
- 7.2 High severity
VMware Workspace ONE Access, Identity Manager…: Deserialization of Untrusted Data
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malici
- 9.8 Critical severity
VMware Workspace ONE Access: Improper Authentication
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authent
- 7.8 High severity
VMware Horizon Agent for Linux: Improper Link Resolution Before File Access
VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file.
- 9.8 Critical severity
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Exploited
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
- 7.8 High severity
Spring Boot: Exposure of Resource to Wrong Sphere
spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only
- 6.5 Medium severity
VMware vCenter Server Incorrect Default File Permissions Exploited
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
- 9.1 Critical severity
VMware Carbon Black App Control (AppC): Unrestricted Upload of File with Dangerous Type
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface m
- 9.1 Critical severity
VMware Carbon Black App Control (AppC): Improper Neutralization of Special Elements used in an OS Command
VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App
- 7.8 High severity
VMware NSX Edge: Improper Neutralization of Special Elements used in an OS Command
VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.
- 7.5 High severity
Omnissa Workspace ONE Server-Side Request Forgery Exploited
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their req