VMware vulnerabilities37 known to be exploited.
VMware has 915 published vulnerabilities across 233 products in our catalogue. 37 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Workstation, with 215. If you run VMware software, patch the exploited flaws first.
The most recent VMware flaw added to the known-exploited list is CVE-2021-22054, on 9 March 2026. We keep watching the known-exploited list.
Which VMware products have the most vulnerabilities?
Workstation leads with 215 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which VMware vulnerabilities are being exploited?
37 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.5Omnissa Workspace ONE Server-Side Request Forgery
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests...
- 9.8Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.
- 7.8Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability.
- 9.3VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write.
- 8.2VMware ESXi Arbitrary Write Vulnerability
VMware ESXi contains an arbitrary write vulnerability.
- 7.1VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.
- 9.8VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol.
- 7.5VMware vCenter Server Privilege Escalation Vulnerability
VMware vCenter contains an improper check for dropped privileges vulnerability.
Which VMware flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server.
- >99%
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.
- >99%
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by...
- >99%
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.
- >99%
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown...
- >99%
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in...
- >99%
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
- >99%
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.
- >99%
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.
- >99%CVE-2021-21978Critical
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability.
All VMware products we track.
218 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Workstationworkstation215 vulnerabilities149 versions
- ESXiesxi138 vulnerabilities20 versions
- Fusionfusion128 vulnerabilities100 versions
- Cloud Foundationcloud_foundation121 vulnerabilities66 versions
- Playerplayer89 vulnerabilities62 versions
- Esxesx86 vulnerabilities21 versions
- vCenter Servervcenter_server75 vulnerabilities16 versions
- Vspherevsphere61 vulnerabilities7 versions
- Serverserver59 vulnerabilities17 versions
- Aceace44 vulnerabilities24 versions
- Spring Frameworkspring_framework43 vulnerabilities258 versions
- Identity Manageridentity_manager28 vulnerabilities7 versions
- Workstation Proworkstation_pro27 vulnerabilities24 versions
- Workstation Playerworkstation_player26 vulnerabilities31 versions
- Horizon Clienthorizon_client25 vulnerabilities33 versions
- Toolstools23 vulnerabilities102 versions
- Spring Securityspring_security22 vulnerabilities258 versions
- Vrealize Suite Lifecycle Managervrealize_suite_lifecycle_manager21 vulnerabilities12 versions
- Vrealize Automationvrealize_automation20 vulnerabilities33 versions
- Vrealize Operationsvrealize_operations18 vulnerabilities23 versions
- Vmware Workstationvmware_workstation15 vulnerabilities21 versions
- Vrealize Log Insightvrealize_log_insight15 vulnerabilities23 versions
- Workspace One Accessworkspace_one_access15 vulnerabilities9 versions
- Horizon Viewhorizon_view14 vulnerabilities54 versions
This directory lists the 218 VMware products with at least one tracked version, of 233 in our catalogue.
Running VMware? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
- Matched to
- Ace on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 915 published vulnerabilities across 233 products and 5,164 versions from VMware. The most recent VMware flaw added to the known-exploited list is CVE-2021-22054, on 9 March 2026.
37 VMware vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-22054, CVE-2024-37079 and CVE-2025-41244. The full list is on this page.
Workstation, with 215 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the VMware products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.