Vendor dossier / #12
VMware vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 26 VMware vulnerabilities as of catalog 2026.09.23, 1.5% of all 1,721 entries and rank 12 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2025-03-04; 9 are flagged as used in ransomware campaigns.
- KEV entries
- 261.5% of catalog
- Last 90 days
- +0added
- Ransomware: known
- 934.6%
- Products
- 14distinct
- First added
- 2021-11-03
- Latest added
- 2025-03-04
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 8 |
| 2022 | 8 |
| 2023 | 2 |
| 2024 | 5 |
| 2025 | 3 |
| 2026 | 0 |
QCommon questions
How many VMware vulnerabilities are in CISA KEV?
26, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 1.5% of the catalog.
Which VMware product has the most KEV entries?
vCenter Server, with 9 entries. 14 products appear in total.
How many VMware KEV vulnerabilities are linked to ransomware?
9 of 26 (34.6%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest VMware vulnerability added to KEV?
2025-03-04 (CVE-2025-22226).
What is the most common weakness in VMware KEV entries?
CWE-94 (Code injection), listed on 3 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| vCenter Server | 9 | 34.6% |
| ESXi | 3 | 11.5% |
| Multiple Products | 3 | 11.5% |
| ESXi, Workstation, and Fusion | 1 | 3.8% |
| ESXi and Workstation | 1 | 3.8% |
| Tools | 1 | 3.8% |
| Aria Operations for Networks | 1 | 3.8% |
| Spring Cloud Gateway | 1 | 3.8% |
| Workspace ONE Access and Identity Manager | 1 | 3.8% |
| Spring Framework | 1 | 3.8% |
| SD-WAN Edge | 1 | 3.8% |
| vCenter Server and Cloud Foundation | 1 | 3.8% |
| vRealize Operations Manager API | 1 | 3.8% |
| VMware ESXi and Horizon DaaS | 1 | 3.8% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-94 Code injection | 3 | 11.5% |
| CWE-918 Server-side request forgery | 3 | 11.5% |
| CWE-23 Relative path traversal | 3 | 11.5% |
| CWE-250 | 2 | 7.7% |
| CWE-787 Out-of-bounds write | 2 | 7.7% |
| CWE-78 OS command injection | 2 | 7.7% |
| CWE-20 Improper input validation | 2 | 7.7% |
| CWE-125 Out-of-bounds read | 1 | 3.8% |
| CWE-123 | 1 | 3.8% |
| CWE-367 | 1 | 3.8% |
| CWE-273 | 1 | 3.8% |
| CWE-122 Heap-based buffer overflow | 1 | 3.8% |
EAll 26 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2025-22226 | ESXi, Workstation, and Fusion | VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability | Unknown | CWE-125 | ||
| CVE-2025-22225 | ESXi | VMware ESXi Arbitrary Write Vulnerability | Known | CWE-123 | ||
| CVE-2025-22224 | ESXi and Workstation | VMware ESXi and Workstation TOCTOU Race Condition Vulnerability | Unknown | CWE-367 | ||
| CVE-2024-38813 | vCenter Server | VMware vCenter Server Privilege Escalation Vulnerability | Unknown | CWE-250, CWE-273 | ||
| CVE-2024-38812 | vCenter Server | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2024-37085 | ESXi | VMware ESXi Authentication Bypass Vulnerability | Known | CWE-305 | ||
| CVE-2022-22948 | vCenter Server | VMware vCenter Server Incorrect Default File Permissions Vulnerability | Unknown | CWE-276 | ||
| CVE-2023-34048 | vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-20867 | Tools | VMware Tools Authentication Bypass Vulnerability | Unknown | CWE-287 | ||
| CVE-2023-20887 | Aria Operations for Networks | Vmware Aria Operations for Networks Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2022-22947 | Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2022-22960 | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | Unknown | CWE-250 | ||
| CVE-2022-22954 | Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | Known | CWE-94 | ||
| CVE-2022-22965 | Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2018-6961 | SD-WAN Edge | VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2021-21973 | vCenter Server and Cloud Foundation | VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability | Unknown | CWE-20, CWE-918 | ||
| CVE-2021-21975 | vRealize Operations Manager API | VMware Server Side Request Forgery in vRealize Operations Manager API | Known | CWE-918 | ||
| CVE-2021-22017 | vCenter Server | VMware vCenter Server Improper Access Control | Unknown | CWE-23 | ||
| CVE-2021-22005 | vCenter Server | VMware vCenter Server File Upload Vulnerability | Known | CWE-23 | ||
| CVE-2021-21985 | vCenter Server | VMware vCenter Server Improper Input Validation Vulnerability | Known | CWE-20, CWE-470, CWE-918 | ||
| CVE-2021-21972 | vCenter Server | VMware vCenter Server Remote Code Execution Vulnerability | Known | CWE-23 | ||
| CVE-2020-4006 | Multiple Products | Multiple VMware Products Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-3992 | ESXi | VMware ESXi OpenSLP Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2020-3952 | vCenter Server | VMware vCenter Server Information Disclosure Vulnerability | Unknown | CWE-306 | ||
| CVE-2020-3950 | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | Unknown | CWE-269 | ||
| CVE-2019-5544 | VMware ESXi and Horizon DaaS | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability | Known | CWE-787 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 26 VMware vulnerabilities (1.5% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/vmware/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about VMware beyond this data.