VMware security vulnerabilities
Virtualization. Public CVE monitoring for VMware ESXi and VMware vCenter. Vendor security advisories are linked on this page.
Built for Virtualization administrators.
171 public records · 0 security-fix timeline events. 0 published in the last 7 days. 89 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 1
- Medium 0
- Low 0
2026-08-042 issues2026-11-01
Known exploited
View all known exploited- Critical9.8VMware Workspace ONE Access and Identity Manager Improper AuthenticationPatch nowKEVEPSS 49.53%Apr 13, 2022
- High7.2VMware cloud_foundation Deserialization of Untrusted DataPatch nowKEVEPSS 23.31%Apr 13, 2022
- Critical9.8Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityPatch nowKEVEPSS 22.38%Jun 17, 2024
- High8.1Broadcom VMware Aria Operations Command Injection VulnerabilityPatch nowKEVEPSS 18.32%Feb 25, 2026
- High7.8Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityPatch nowKEVEPSS 8.63%Sep 29, 2025
- Critical9.8Broadcom VMware vCenter Path Traversal VulnerabilityPatch nowKEVEPSS 2.56%Jul 30, 2026
- Medium6.9VMware Products Guest Privilege Escalation VulnerabilityPatch nowKEVEPSS 1.75%Nov 2, 2009
- Low2.7VMware cloud_foundation Insufficient LoggingPatch nowKEVEPSS 0.69%Jul 30, 2026
Recently published
Browse catalog- High7.5ZDI-26-647: VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.41%Sep 9, 2026
- Critical9.8In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched.Check if you run itEPSS 0.25%Aug 21, 2026
- Critical9.8Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)Patch nowKEVEPSS 0.61%Jul 30, 2026
- Critical9.8Broadcom VMware vCenter Path Traversal VulnerabilityPatch nowKEVEPSS 2.56%Jul 30, 2026
- Medium6.5OOM error is possible while attempting to add infinite amount of functions to Function Registry.Check if you run itEPSS 0.21%Jun 1, 2026
- Medium6.5Under infinite recursion in the routing layer, request-handling can cause OOM error.Check if you run itEPSS 0.21%Jun 1, 2026
- Medium6.5Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk.Check if you run itEPSS 0.40%May 25, 2026
- High7.0VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary.Check if you run itEPSS 0.17%May 15, 2026
- High8.8A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.Check if you run itEPSS 0.11%May 13, 2026
- High8.8A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.Check if you run itEPSS 0.10%May 13, 2026