Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Cloud workload protection · in CISA KEV

VMware in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 29 entries for VMware as of catalog version 2026.11.06, released November 6, 2026. The newest was added March 4, 2025, and the latest federal due date is March 25, 2025. CISA marks 10 of them as known ransomware use.

Updated

entries in the catalog
29
newest addition
March 4, 2025
latest federal due date
March 25, 2025
marked known ransomware use
10

Directory record

Website
www.vmware.com
Category
Cloud workload protection
Headquarters
HQ not established
Founded
Not established
Ownership
Ownership not established
Company record
VMware on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the names “VMware”, “VMware Tanzu”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added March 4, 2025

    CVE-2025-22226 VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

    ESXi, Workstation, and Fusion

    Due March 25, 2025

  2. Added March 4, 2025

    CVE-2025-22225 VMware ESXi Arbitrary Write Vulnerability

    ESXi · known ransomware use

    Due March 25, 2025

  3. Added March 4, 2025

    CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

    ESXi and Workstation

    Due March 25, 2025

  4. Added November 20, 2024

    CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

    vCenter Server

    Due December 11, 2024

  5. Added November 20, 2024

    CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

    vCenter Server

    Due December 11, 2024

  6. Added July 30, 2024

    CVE-2024-37085 VMware ESXi Authentication Bypass Vulnerability

    ESXi · known ransomware use

    Due August 20, 2024

  7. Added July 17, 2024

    CVE-2022-22948 VMware vCenter Server Incorrect Default File Permissions Vulnerability

    vCenter Server

    Due August 7, 2024

  8. Added January 22, 2024

    CVE-2023-34048 VMware vCenter Server Out-of-Bounds Write Vulnerability

    vCenter Server

    Due February 12, 2024

  9. Added June 23, 2023

    CVE-2023-20867 VMware Tools Authentication Bypass Vulnerability

    Tools

    Due July 14, 2023

  10. Added June 22, 2023

    CVE-2023-20887 Vmware Aria Operations for Networks Command Injection Vulnerability

    Aria Operations for Networks

    Due July 13, 2023

  11. Added August 25, 2022

    CVE-2022-22963 VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

    Spring Cloud

    Due September 15, 2022

  12. Added May 16, 2022

    CVE-2022-22947 VMware Spring Cloud Gateway Code Injection Vulnerability

    Spring Cloud Gateway

    Due June 6, 2022

  13. Added April 15, 2022

    CVE-2022-22960 VMware Multiple Products Privilege Escalation Vulnerability

    Multiple Products

    Due May 6, 2022

  14. Added April 14, 2022

    CVE-2022-22954 VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

    Workspace ONE Access and Identity Manager · known ransomware use

    Due May 5, 2022

  15. Added April 4, 2022

    CVE-2022-22965 Spring Framework JDK 9+ Remote Code Execution Vulnerability

    Spring Framework

    Due April 25, 2022

  16. Added March 25, 2022

    CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

    Spring Cloud Configuration (Config) Server

    Due April 15, 2022

  17. Added March 25, 2022

    CVE-2018-6961 VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability

    SD-WAN Edge

    Due April 15, 2022

  18. Added March 25, 2022

    CVE-2018-1273 VMware Tanzu Spring Data Commons Property Binder Vulnerability

    Spring Data Commons · known ransomware use

    Due April 15, 2022

  19. Added March 7, 2022

    CVE-2021-21973 VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability

    vCenter Server and Cloud Foundation

    Due March 21, 2022

  20. Added January 18, 2022

    CVE-2021-21975 VMware Server Side Request Forgery in vRealize Operations Manager API

    vRealize Operations Manager API · known ransomware use

    Due February 1, 2022

  21. Added January 10, 2022

    CVE-2021-22017 VMware vCenter Server Improper Access Control

    vCenter Server

    Due January 24, 2022

  22. Added November 3, 2021

    CVE-2021-22005 VMware vCenter Server File Upload Vulnerability

    vCenter Server · known ransomware use

    Due November 17, 2021

  23. Added November 3, 2021

    CVE-2021-21985 VMware vCenter Server Improper Input Validation Vulnerability

    vCenter Server · known ransomware use

    Due November 17, 2021

  24. Added November 3, 2021

    CVE-2021-21972 VMware vCenter Server Remote Code Execution Vulnerability

    vCenter Server · known ransomware use

    Due November 17, 2021

  25. Added November 3, 2021

    CVE-2020-4006 Multiple VMware Products Command Injection Vulnerability

    Multiple Products

    Due May 3, 2022

  26. Added November 3, 2021

    CVE-2020-3992 VMware ESXi OpenSLP Use-After-Free Vulnerability

    ESXi · known ransomware use

    Due May 3, 2022

  27. Added November 3, 2021

    CVE-2020-3952 VMware vCenter Server Information Disclosure Vulnerability

    vCenter Server

    Due May 3, 2022

  28. Added November 3, 2021

    CVE-2020-3950 VMware Multiple Products Privilege Escalation Vulnerability

    Multiple Products

    Due May 3, 2022

  29. Added November 3, 2021

    CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

    VMware ESXi and Horizon DaaS · known ransomware use

    Due May 3, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Daily briefing · October 31, 2026

    Chinese actors chained VMware ESX and Linux zero-days to root firewalls

  2. Daily briefing · October 30, 2026

    Chinese Actors Exploit VMware ESX Zero-Day and Chain Flaws to Root Firewalls

  3. Daily briefing · October 29, 2026

    CISA adds VMware ESX and Linux Kernel flaws to exploited-vulnerability catalog

  4. Weekly archive · Aug 17 – Aug 23, 2026

    CISA Adds Four Actively Exploited Flaws Including Microsoft and VMware Bugs

  5. Weekly archive · Mar 2 – Mar 8, 2026

    CISA Flags Qualcomm and Broadcom VMware Flaws as Exploited

  6. Weekly archive · Oct 27 – Nov 2, 2025

    XWiki and VMware Aria Flaws Added to CISA's Exploited Vulnerabilities Catalog

  7. Weekly archive · Mar 3 – Mar 9, 2025

    CISA Adds VMware ESXi Flaws to Exploited Vulnerabilities List

  8. Weekly archive · Oct 21 – Oct 27, 2024

    Broadcom Re-Patches Critical VMware vCenter RCE Flaw

  9. Weekly archive · Sep 16 – Sep 22, 2024

    VMware Advisory Covers Cloud Foundation and vCenter Flaws

  10. Weekly archive · Jul 29 – Aug 4, 2024

    CISA Adds Actively Exploited VMware ESXi Flaw to KEV Catalog

  11. Weekly archive · Feb 5 – Feb 11, 2024

    VMware Fixes Multiple Flaws in Aria Operations for Networks

  12. Weekly archive · Oct 23 – Oct 29, 2023

    VMware Discloses vCenter Server Out-of-Bounds Write Flaws

  13. Weekly archive · Aug 28 – Sep 3, 2023

    VMware Fixes Critical Authentication-Bypass Bug in Aria Operations for Networks

  14. Weekly archive · Jun 19 – Jun 25, 2023

    CISA Adds Six More KEVs, Including VMware Aria and Roundcube Bugs

  15. Weekly archive · Jun 19 – Jun 25, 2023

    VMware Patches Memory Corruption Flaws in vCenter Server

  16. Weekly archive · Jun 5 – Jun 11, 2023

    VMware Patches Critical Command Injection Flaw in Aria Operations for Networks

  17. Weekly archive · Apr 24 – Apr 30, 2023

    VMware patches two Aria Operations for Logs vulnerabilities

  18. Weekly archive · Apr 17 – Apr 23, 2023

    VMware Patches Aria Operations for Logs Vulnerabilities

  19. Weekly archive · Feb 20 – Feb 26, 2023

    VMware Patches Carbon Black App Control Vulnerability

  20. Weekly archive · Feb 6 – Feb 12, 2023

    ESXiArgs Ransomware Hits Thousands of VMware ESXi Servers

  21. Weekly archive · Jan 23 – Jan 29, 2023

    VMware Patches vRealize Log Insight Against Remote Takeover Flaws

  22. Weekly archive · Sep 26 – Oct 2, 2022

    VMware Issues Guidance on ESXi-Targeting Malware

  23. Weekly archive · Aug 1 – Aug 7, 2022

    VMware: patch the CVE-2022-31656 authentication bypass immediately

  24. Weekly archive · Jul 25 – Jul 31, 2022

    CISA Details Log4Shell Exploitation of Unpatched VMware Horizon Server

  25. Weekly archive · Jul 18 – Jul 24, 2022

    CISA Refreshes Log4Shell Advisory for VMware Horizon Systems

  26. Weekly archive · Jun 20 – Jun 26, 2022

    Log4Shell exploitation of VMware Horizon continues six months on

  27. Weekly archive · May 30 – Jun 5, 2022

    CISA Updates Advisory on VMware Vulnerability Chaining

  28. Weekly archive · May 23 – May 29, 2022

    Broadcom agrees to acquire VMware for $61 billion

  29. Weekly archive · May 16 – May 22, 2022

    CISA Issues Emergency Directive Over Active VMware Vulnerability Exploitation

  30. Weekly archive · May 16 – May 22, 2022

    CISA Adds Zyxel Firewall and VMware Spring Cloud Gateway Flaws to KEV Catalog

  31. Weekly archive · Apr 11 – Apr 17, 2022

    CISA adds exploited VMware Workspace ONE Access flaw to KEV Catalog

  32. Weekly archive · Apr 11 – Apr 17, 2022

    VMware patches remote code execution flaw in Cloud Director

  33. Weekly archive · Apr 4 – Apr 10, 2022

    VMware Issues Security Updates Across Multiple Products

  34. Weekly archive · Mar 21 – Mar 27, 2022

    VMware Patches Carbon Black App Control Vulnerabilities

  35. Weekly archive · Jan 3 – Jan 9, 2022

    VMware fixes a take-over flaw in Workstation, Fusion and ESXi

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for VMware, published November 8, 2026