VMware: CISA KEV History
Every VMware vulnerability in the CISA Known Exploited Vulnerabilities catalog: confirmed in-the-wild exploitation, addition timeline, and ransomware linkage. Rebuilt automatically on every site deploy.
Snapshot: 2026-09-08 · Source: CISA KEV Catalog · Full KEV dashboard
KEV entries
26
Added, last 12 months
0
Ransomware-linked
9
Latest addition
2025-03-04
VMware KEV additions per month, last 24 months
Most-listed products: vCenter Server, ESXi, Multiple Products, ESXi, Workstation, and Fusion, ESXi and Workstation.
Latest 26 of 26 VMware KEV entries
| CVE | Vulnerability | Added | Ransomware |
|---|---|---|---|
| CVE-2025-22226 | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | 2025-03-04 | No |
| CVE-2025-22225 | VMware ESXi Arbitrary Write Vulnerability | 2025-03-04 | Yes |
| CVE-2025-22224 | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | 2025-03-04 | No |
| CVE-2024-38813 | VMware vCenter Server Privilege Escalation Vulnerability | 2024-11-20 | No |
| CVE-2024-38812 | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 2024-11-20 | No |
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | 2024-07-30 | Yes |
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 2024-07-17 | No |
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability | 2024-01-22 | No |
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | 2023-06-23 | No |
| CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability | 2023-06-22 | No |
| CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability | 2022-05-16 | No |
| CVE-2022-22960 | VMware Multiple Products Privilege Escalation Vulnerability | 2022-04-15 | No |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerabil | 2022-04-14 | Yes |
| CVE-2022-22965 | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 2022-04-04 | No |
| CVE-2018-6961 | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | 2022-03-25 | No |
| CVE-2021-21973 | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerabilit | 2022-03-07 | No |
| CVE-2021-21975 | VMware Server Side Request Forgery in vRealize Operations Manager API | 2022-01-18 | Yes |
| CVE-2021-22017 | VMware vCenter Server Improper Access Control | 2022-01-10 | No |
| CVE-2019-5544 | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | 2021-11-03 | Yes |
| CVE-2020-3992 | VMware ESXi OpenSLP Use-After-Free Vulnerability | 2021-11-03 | Yes |
| CVE-2020-3950 | VMware Multiple Products Privilege Escalation Vulnerability | 2021-11-03 | No |
| CVE-2021-22005 | VMware vCenter Server File Upload Vulnerability | 2021-11-03 | Yes |
| CVE-2020-3952 | VMware vCenter Server Information Disclosure Vulnerability | 2021-11-03 | No |
| CVE-2021-21972 | VMware vCenter Server Remote Code Execution Vulnerability | 2021-11-03 | Yes |
| CVE-2021-21985 | VMware vCenter Server Improper Input Validation Vulnerability | 2021-11-03 | Yes |
| CVE-2020-4006 | Multiple VMware Products Command Injection Vulnerability | 2021-11-03 | No |
CVE links go to our explainer when one exists, otherwise to the NVD record.
Data: official CISA KEV catalog, fetched at build time. Figures may be reused with attribution to East Bay Cyber and CISA. See also the KEV Velocity Dashboard and all tracked vendors.