# VMware vulnerabilities > VMware has 915 published vulnerabilities across 233 products in our catalogue. 37 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Workstation, with 215. If you run VMware software, patch the exploited flaws first. Canonical page: https://www.precursorintelligence.com/vendors/vmware ## At a glance - **Published vulnerabilities:** 915 - **Known to be exploited:** 37 - **Products:** 233 - **Versions:** 5,164 - **Most recently added to the known-exploited list:** [CVE-2021-22054](https://www.precursorintelligence.com/what-is/cve-2021-22054), 9 March 2026. We keep watching the list. ## Which VMware products have the most vulnerabilities? - [Workstation](https://www.precursorintelligence.com/product/vmware/workstation): 215 published vulnerabilities, 149 versions - [ESXi](https://www.precursorintelligence.com/product/vmware/esxi): 138 published vulnerabilities, 20 versions - [Fusion](https://www.precursorintelligence.com/product/vmware/fusion): 128 published vulnerabilities, 100 versions - [Cloud Foundation](https://www.precursorintelligence.com/product/vmware/cloud_foundation): 121 published vulnerabilities, 66 versions - [Player](https://www.precursorintelligence.com/product/vmware/player): 89 published vulnerabilities, 62 versions - [Esx](https://www.precursorintelligence.com/product/vmware/esx): 86 published vulnerabilities, 21 versions - [vCenter Server](https://www.precursorintelligence.com/product/vmware/vcenter_server): 75 published vulnerabilities, 16 versions - [Vsphere](https://www.precursorintelligence.com/product/vmware/vsphere): 61 published vulnerabilities, 7 versions - [Server](https://www.precursorintelligence.com/product/vmware/server): 59 published vulnerabilities, 17 versions - [Ace](https://www.precursorintelligence.com/product/vmware/ace): 44 published vulnerabilities, 24 versions Each product page lists its own known-exploited flaws. ## Which VMware vulnerabilities are being exploited? 37 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2021-22054](https://www.precursorintelligence.com/what-is/cve-2021-22054): Omnissa Workspace ONE Server-Side Request Forgery. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 9 March 2026. - [CVE-2024-37079](https://www.precursorintelligence.com/what-is/cve-2024-37079): Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 22%, known exploited since 23 January 2026. - [CVE-2025-41244](https://www.precursorintelligence.com/what-is/cve-2025-41244): Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability. High, CVSS 7.8, chance of use in 30 days 8.4%, known exploited since 30 October 2025. - [CVE-2025-22224](https://www.precursorintelligence.com/what-is/cve-2025-22224): VMware ESXi and Workstation TOCTOU Race Condition Vulnerability. Critical, CVSS 9.3, chance of use in 30 days 1.6%, known exploited since 4 March 2025. - [CVE-2025-22225](https://www.precursorintelligence.com/what-is/cve-2025-22225): VMware ESXi Arbitrary Write Vulnerability. High, CVSS 8.2, chance of use in 30 days 1.0%, known exploited since 4 March 2025. - [CVE-2025-22226](https://www.precursorintelligence.com/what-is/cve-2025-22226): VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability. High, CVSS 7.1, chance of use in 30 days 1.8%, known exploited since 4 March 2025. - [CVE-2024-38812](https://www.precursorintelligence.com/what-is/cve-2024-38812): VMware vCenter Server Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 55%, known exploited since 20 November 2024. - [CVE-2024-38813](https://www.precursorintelligence.com/what-is/cve-2024-38813): VMware vCenter Server Privilege Escalation Vulnerability. High, CVSS 7.5, chance of use in 30 days 17%, known exploited since 20 November 2024. - [CVE-2024-37085](https://www.precursorintelligence.com/what-is/cve-2024-37085): VMware ESXi Authentication Bypass Vulnerability. Medium, CVSS 6.8, chance of use in 30 days 27%, known exploited since 30 July 2024. - [CVE-2022-22948](https://www.precursorintelligence.com/what-is/cve-2022-22948): VMware vCenter Server Incorrect Default File Permissions Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 13%, known exploited since 17 July 2024. - [CVE-2023-34048](https://www.precursorintelligence.com/what-is/cve-2023-34048): VMware vCenter Server Out-of-Bounds Write Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 22 January 2024. - [CVE-2023-29552](https://www.precursorintelligence.com/what-is/cve-2023-29552): Service Location Protocol (SLP) Denial-of-Service Vulnerability. High, CVSS 7.5, chance of use in 30 days 64%, known exploited since 8 November 2023. - [CVE-2023-20867](https://www.precursorintelligence.com/what-is/cve-2023-20867): VMware Tools Authentication Bypass Vulnerability. Low, CVSS 3.9, chance of use in 30 days 14%, known exploited since 23 June 2023. - [CVE-2023-20887](https://www.precursorintelligence.com/what-is/cve-2023-20887): Vmware Aria Operations for Networks Command Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 98%, known exploited since 22 June 2023. - [CVE-2010-3904](https://www.precursorintelligence.com/what-is/cve-2010-3904): Linux Kernel Improper Input Validation Vulnerability. High, CVSS 7.8, chance of use in 30 days 16%, known exploited since 12 May 2023. - [CVE-2022-22963](https://www.precursorintelligence.com/what-is/cve-2022-22963): VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 25 August 2022. - [CVE-2022-22947](https://www.precursorintelligence.com/what-is/cve-2022-22947): VMware Spring Cloud Gateway Code Injection Vulnerability. Critical, CVSS 10.0, chance of use in 30 days 98%, known exploited since 16 May 2022. - [CVE-2022-22960](https://www.precursorintelligence.com/what-is/cve-2022-22960): VMware Multiple Products Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 36%, known exploited since 15 April 2022. - [CVE-2022-22954](https://www.precursorintelligence.com/what-is/cve-2022-22954): VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 14 April 2022. - [CVE-2022-22965](https://www.precursorintelligence.com/what-is/cve-2022-22965): Spring Framework JDK 9+ Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 4 April 2022. - [CVE-2018-6961](https://www.precursorintelligence.com/what-is/cve-2018-6961): VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability. High, CVSS 8.1, chance of use in 30 days 86%, known exploited since 25 March 2022. - [CVE-2020-5410](https://www.precursorintelligence.com/what-is/cve-2020-5410): VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability. High, CVSS 7.5, chance of use in 30 days 96%, known exploited since 25 March 2022. - [CVE-2021-21973](https://www.precursorintelligence.com/what-is/cve-2021-21973): VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability. Medium, CVSS 5.3, chance of use in 30 days 88%, known exploited since 7 March 2022. - [CVE-2014-7169](https://www.precursorintelligence.com/what-is/cve-2014-7169): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 28 January 2022. - [CVE-2014-6271](https://www.precursorintelligence.com/what-is/cve-2014-6271): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 28 January 2022. - [CVE-2021-21975](https://www.precursorintelligence.com/what-is/cve-2021-21975): VMware Server Side Request Forgery in vRealize Operations Manager API. High, CVSS 7.5, chance of use in 30 days 78%, known exploited since 18 January 2022. - [CVE-2021-22017](https://www.precursorintelligence.com/what-is/cve-2021-22017): VMware vCenter Server Improper Access Control. Medium, CVSS 5.3, chance of use in 30 days 49%, known exploited since 10 January 2022. - [CVE-2020-3992](https://www.precursorintelligence.com/what-is/cve-2020-3992): VMware ESXi OpenSLP Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 83%, known exploited since 3 November 2021. - [CVE-2021-22005](https://www.precursorintelligence.com/what-is/cve-2021-22005): VMware vCenter Server File Upload Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021. - [CVE-2020-11651](https://www.precursorintelligence.com/what-is/cve-2020-11651): SaltStack Salt Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 3 November 2021. - [CVE-2021-21972](https://www.precursorintelligence.com/what-is/cve-2021-21972): VMware vCenter Server Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021. - [CVE-2021-21985](https://www.precursorintelligence.com/what-is/cve-2021-21985): VMware vCenter Server Improper Input Validation Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 3 November 2021. - [CVE-2020-3952](https://www.precursorintelligence.com/what-is/cve-2020-3952): VMware vCenter Server Information Disclosure Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 90%, known exploited since 3 November 2021. - [CVE-2019-5544](https://www.precursorintelligence.com/what-is/cve-2019-5544): VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 97%, known exploited since 3 November 2021. - [CVE-2020-4006](https://www.precursorintelligence.com/what-is/cve-2020-4006): Multiple VMware Products Command Injection Vulnerability. Critical, CVSS 9.1, chance of use in 30 days 17%, known exploited since 3 November 2021. - [CVE-2020-3950](https://www.precursorintelligence.com/what-is/cve-2020-3950): VMware Multiple Products Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 7.3%, known exploited since 3 November 2021. - [CVE-2020-11652](https://www.precursorintelligence.com/what-is/cve-2020-11652): SaltStack Salt Path Traversal Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 86%, known exploited since 3 November 2021. ## Which VMware flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2014-6271](https://www.precursorintelligence.com/what-is/cve-2014-6271): >99%, Critical (CVSS 9.8), known exploited - [CVE-2021-21985](https://www.precursorintelligence.com/what-is/cve-2021-21985): >99%, Critical (CVSS 9.8), known exploited - [CVE-2021-22005](https://www.precursorintelligence.com/what-is/cve-2021-22005): >99%, Critical (CVSS 9.8), known exploited - [CVE-2022-22954](https://www.precursorintelligence.com/what-is/cve-2022-22954): >99%, Critical (CVSS 9.8), known exploited - [CVE-2014-7169](https://www.precursorintelligence.com/what-is/cve-2014-7169): >99%, Critical (CVSS 9.8), known exploited - [CVE-2022-22963](https://www.precursorintelligence.com/what-is/cve-2022-22963): >99%, Critical (CVSS 9.8), known exploited - [CVE-2021-21972](https://www.precursorintelligence.com/what-is/cve-2021-21972): >99%, Critical (CVSS 9.8), known exploited - [CVE-2021-22054](https://www.precursorintelligence.com/what-is/cve-2021-22054): >99%, High (CVSS 7.5), known exploited - [CVE-2022-22965](https://www.precursorintelligence.com/what-is/cve-2022-22965): >99%, Critical (CVSS 9.8), known exploited - [CVE-2023-34048](https://www.precursorintelligence.com/what-is/cve-2023-34048): >99%, Critical (CVSS 9.8), known exploited ## All VMware products we track 218 products with at least one tracked version, most vulnerabilities first (the top 150 here; every product is on the page): - [Workstation](https://www.precursorintelligence.com/product/vmware/workstation): 215 vulnerabilities, 149 versions - [ESXi](https://www.precursorintelligence.com/product/vmware/esxi): 138 vulnerabilities, 20 versions - [Fusion](https://www.precursorintelligence.com/product/vmware/fusion): 128 vulnerabilities, 100 versions - [Cloud Foundation](https://www.precursorintelligence.com/product/vmware/cloud_foundation): 121 vulnerabilities, 66 versions - [Player](https://www.precursorintelligence.com/product/vmware/player): 89 vulnerabilities, 62 versions - [Esx](https://www.precursorintelligence.com/product/vmware/esx): 86 vulnerabilities, 21 versions - [vCenter Server](https://www.precursorintelligence.com/product/vmware/vcenter_server): 75 vulnerabilities, 16 versions - [Vsphere](https://www.precursorintelligence.com/product/vmware/vsphere): 61 vulnerabilities, 7 versions - [Server](https://www.precursorintelligence.com/product/vmware/server): 59 vulnerabilities, 17 versions - [Ace](https://www.precursorintelligence.com/product/vmware/ace): 44 vulnerabilities, 24 versions - [Spring Framework](https://www.precursorintelligence.com/product/vmware/spring_framework): 43 vulnerabilities, 258 versions - [Identity Manager](https://www.precursorintelligence.com/product/vmware/identity_manager): 28 vulnerabilities, 7 versions - [Workstation Pro](https://www.precursorintelligence.com/product/vmware/workstation_pro): 27 vulnerabilities, 24 versions - [Workstation Player](https://www.precursorintelligence.com/product/vmware/workstation_player): 26 vulnerabilities, 31 versions - [Horizon Client](https://www.precursorintelligence.com/product/vmware/horizon_client): 25 vulnerabilities, 33 versions - [Tools](https://www.precursorintelligence.com/product/vmware/tools): 23 vulnerabilities, 102 versions - [Spring Security](https://www.precursorintelligence.com/product/vmware/spring_security): 22 vulnerabilities, 258 versions - [Vrealize Suite Lifecycle Manager](https://www.precursorintelligence.com/product/vmware/vrealize_suite_lifecycle_manager): 21 vulnerabilities, 12 versions - [Vrealize Automation](https://www.precursorintelligence.com/product/vmware/vrealize_automation): 20 vulnerabilities, 33 versions - [Vrealize Operations](https://www.precursorintelligence.com/product/vmware/vrealize_operations): 18 vulnerabilities, 23 versions - [Vrealize Log Insight](https://www.precursorintelligence.com/product/vmware/vrealize_log_insight): 15 vulnerabilities, 23 versions - [Workspace One Access](https://www.precursorintelligence.com/product/vmware/workspace_one_access): 15 vulnerabilities, 9 versions - [Vmware Workstation](https://www.precursorintelligence.com/product/vmware/vmware_workstation): 15 vulnerabilities, 21 versions - [Horizon View](https://www.precursorintelligence.com/product/vmware/horizon_view): 14 vulnerabilities, 54 versions - [Vcenter Server Appliance](https://www.precursorintelligence.com/product/vmware/vcenter_server_appliance): 14 vulnerabilities, 4 versions - [Identity Manager Connector](https://www.precursorintelligence.com/product/vmware/identity_manager_connector): 13 vulnerabilities, 7 versions - [One Access](https://www.precursorintelligence.com/product/vmware/one_access): 11 vulnerabilities, 4 versions - [Aria Operations](https://www.precursorintelligence.com/product/vmware/aria_operations): 10 vulnerabilities, 16 versions - [Virtualcenter](https://www.precursorintelligence.com/product/vmware/virtualcenter): 10 vulnerabilities, 5 versions - [Spring Boot](https://www.precursorintelligence.com/product/vmware/spring_boot): 9 vulnerabilities, 196 versions - [Vmware Server](https://www.precursorintelligence.com/product/vmware/vmware_server): 9 vulnerabilities, 11 versions - [Access Connector](https://www.precursorintelligence.com/product/vmware/access_connector): 9 vulnerabilities, 5 versions - [Esx Server](https://www.precursorintelligence.com/product/vmware/esx_server): 8 vulnerabilities, 25 versions - [Vrealize Operations Manager](https://www.precursorintelligence.com/product/vmware/vrealize_operations_manager): 8 vulnerabilities, 8 versions - [Aria Operations for Networks](https://www.precursorintelligence.com/product/vmware/aria_operations_for_networks): 8 vulnerabilities, 12 versions - [Aria Operations for Logs](https://www.precursorintelligence.com/product/vmware/aria_operations_for_logs): 8 vulnerabilities, 15 versions - [Vsphere Data Protection](https://www.precursorintelligence.com/product/vmware/vsphere_data_protection): 8 vulnerabilities, 33 versions - [Vma](https://www.precursorintelligence.com/product/vmware/vma): 7 vulnerabilities, 3 versions - [View](https://www.precursorintelligence.com/product/vmware/view): 7 vulnerabilities, 11 versions - [Movie Decoder](https://www.precursorintelligence.com/product/vmware/movie_decoder): 6 vulnerabilities, 7 versions - [Photon OS](https://www.precursorintelligence.com/product/vmware/photon_os): 6 vulnerabilities, 5 versions - [Horizon View Client](https://www.precursorintelligence.com/product/vmware/horizon_view_client): 6 vulnerabilities, 2 versions - [Remote Console](https://www.precursorintelligence.com/product/vmware/remote_console): 6 vulnerabilities, 16 versions - [Rabbitmq](https://www.precursorintelligence.com/product/vmware/rabbitmq): 6 vulnerabilities, 177 versions - [SD-WAN Orchestrator](https://www.precursorintelligence.com/product/vmware/sd-wan_orchestrator): 6 vulnerabilities, 5 versions - [Horizon](https://www.precursorintelligence.com/product/vmware/horizon): 6 vulnerabilities, 53 versions - [Gsx Server](https://www.precursorintelligence.com/product/vmware/gsx_server): 6 vulnerabilities, 10 versions - [Fusion Pro](https://www.precursorintelligence.com/product/vmware/fusion_pro): 5 vulnerabilities, 11 versions - [Vcenter](https://www.precursorintelligence.com/product/vmware/vcenter): 5 vulnerabilities, 2 versions - [Vmware Player](https://www.precursorintelligence.com/product/vmware/vmware_player): 5 vulnerabilities, 21 versions - [Vcloud Director](https://www.precursorintelligence.com/product/vmware/vcloud_director): 5 vulnerabilities, 28 versions - [Workspace One Assist](https://www.precursorintelligence.com/product/vmware/workspace_one_assist): 5 vulnerabilities, 1 version - [Spring Cloud Config](https://www.precursorintelligence.com/product/vmware/spring_cloud_config): 4 vulnerabilities, 45 versions - [Telco Cloud Platform](https://www.precursorintelligence.com/product/vmware/telco_cloud_platform): 4 vulnerabilities, 8 versions - [Open VM Tools](https://www.precursorintelligence.com/product/vmware/open_vm_tools): 4 vulnerabilities, 103 versions - [Telco Cloud Infrastructure](https://www.precursorintelligence.com/product/vmware/telco_cloud_infrastructure): 4 vulnerabilities, 4 versions - [Horizon Daas](https://www.precursorintelligence.com/product/vmware/horizon_daas): 4 vulnerabilities, 4 versions - [Spring Advanced Message Queuing Protocol](https://www.precursorintelligence.com/product/vmware/spring_advanced_message_queuing_protocol): 4 vulnerabilities, 104 versions - [Carbon Black App Control](https://www.precursorintelligence.com/product/vmware/carbon_black_app_control): 4 vulnerabilities, 18 versions - [Springsource Spring Security](https://www.precursorintelligence.com/product/vmware/springsource_spring_security): 4 vulnerabilities, 17 versions - [Vsphere Client](https://www.precursorintelligence.com/product/vmware/vsphere_client): 4 vulnerabilities, 15 versions - [Airwatch](https://www.precursorintelligence.com/product/vmware/airwatch): 4 vulnerabilities, 14 versions - [Studio](https://www.precursorintelligence.com/product/vmware/studio): 3 vulnerabilities, 1 version - [Installbuilder](https://www.precursorintelligence.com/product/vmware/installbuilder): 3 vulnerabilities, 5 versions - [Single Sign-on for Pivotal Cloud Foundry](https://www.precursorintelligence.com/product/vmware/single_sign-on_for_pivotal_cloud_foundry): 3 vulnerabilities, 7 versions - [Spring Integration Zip](https://www.precursorintelligence.com/product/vmware/spring_integration_zip): 3 vulnerabilities, 6 versions - [Vrealize Orchestrator](https://www.precursorintelligence.com/product/vmware/vrealize_orchestrator): 3 vulnerabilities, 3 versions - [Ixgben](https://www.precursorintelligence.com/product/vmware/ixgben): 3 vulnerabilities, 4 versions - [Spring Cloud Gateway](https://www.precursorintelligence.com/product/vmware/spring_cloud_gateway): 3 vulnerabilities, 41 versions - [Cloud Director](https://www.precursorintelligence.com/product/vmware/cloud_director): 3 vulnerabilities, 3 versions - [Airwatch Agent](https://www.precursorintelligence.com/product/vmware/airwatch_agent): 3 vulnerabilities, 2 versions - [NSX-T Data Center](https://www.precursorintelligence.com/product/vmware/nsx-t_data_center): 3 vulnerabilities, 47 versions - [Vrealize Network Insight](https://www.precursorintelligence.com/product/vmware/vrealize_network_insight): 3 vulnerabilities, 6 versions - [Vmware Player 2](https://www.precursorintelligence.com/product/vmware/vmware_player_2): 2 vulnerabilities, 7 versions - [Vcenter Chargeback Manager](https://www.precursorintelligence.com/product/vmware/vcenter_chargeback_manager): 2 vulnerabilities, 8 versions - [Rabbitmq Java Client](https://www.precursorintelligence.com/product/vmware/rabbitmq_java_client): 2 vulnerabilities, 68 versions - [Tc Server](https://www.precursorintelligence.com/product/vmware/tc_server): 2 vulnerabilities, 15 versions - [Tanzu Gemfire for Virtual Machines](https://www.precursorintelligence.com/product/vmware/tanzu_gemfire_for_virtual_machines): 2 vulnerabilities, 4 versions - [Tanzu Application Service for Virtual Machines](https://www.precursorintelligence.com/product/vmware/tanzu_application_service_for_virtual_machines): 2 vulnerabilities, 14 versions - [Aria Automation](https://www.precursorintelligence.com/product/vmware/aria_automation): 2 vulnerabilities, 15 versions - [Spring Integration](https://www.precursorintelligence.com/product/vmware/spring_integration): 2 vulnerabilities, 139 versions - [App Volumes](https://www.precursorintelligence.com/product/vmware/app_volumes): 2 vulnerabilities, 20 versions - [Workspace One Uem Console](https://www.precursorintelligence.com/product/vmware/workspace_one_uem_console): 2 vulnerabilities, 13 versions - [Application Remote Collector](https://www.precursorintelligence.com/product/vmware/application_remote_collector): 2 vulnerabilities, 2 versions - [Spring Cloud Data Flow](https://www.precursorintelligence.com/product/vmware/spring_cloud_data_flow): 2 vulnerabilities, 77 versions - [Spring Cloud Function](https://www.precursorintelligence.com/product/vmware/spring_cloud_function): 2 vulnerabilities, 39 versions - [Spring Cloud Netflix](https://www.precursorintelligence.com/product/vmware/spring_cloud_netflix): 2 vulnerabilities, 13 versions - [Spring Data Rest](https://www.precursorintelligence.com/product/vmware/spring_data_rest): 2 vulnerabilities, 6 versions - [Workspace One Content](https://www.precursorintelligence.com/product/vmware/workspace_one_content): 2 vulnerabilities, 5 versions - [Gemfire](https://www.precursorintelligence.com/product/vmware/gemfire): 2 vulnerabilities, 6 versions - [Vsphere Esxi](https://www.precursorintelligence.com/product/vmware/vsphere_esxi): 2 vulnerabilities, 3 versions - [Vmware Esx](https://www.precursorintelligence.com/product/vmware/vmware_esx): 2 vulnerabilities, 3 versions - [Ace 2](https://www.precursorintelligence.com/product/vmware/ace_2): 2 vulnerabilities, 3 versions - [Infrastructure](https://www.precursorintelligence.com/product/vmware/infrastructure): 2 vulnerabilities, 1 version - [VM-Support](https://www.precursorintelligence.com/product/vmware/vm-support): 2 vulnerabilities, 1 version - [Workspace One Boxer](https://www.precursorintelligence.com/product/vmware/workspace_one_boxer): 2 vulnerabilities, 6 versions - [Virtual Infrastructure Client](https://www.precursorintelligence.com/product/vmware/virtual_infrastructure_client): 2 vulnerabilities, 4 versions - [Vix API](https://www.precursorintelligence.com/product/vmware/vix_api): 2 vulnerabilities, 13 versions - [Access](https://www.precursorintelligence.com/product/vmware/access): 2 vulnerabilities, 3 versions - [Vcenter Orchestrator](https://www.precursorintelligence.com/product/vmware/vcenter_orchestrator): 2 vulnerabilities, 11 versions - [Hyperic Server](https://www.precursorintelligence.com/product/vmware/hyperic_server): 2 vulnerabilities, 3 versions - [NSX Data Center](https://www.precursorintelligence.com/product/vmware/nsx_data_center): 2 vulnerabilities, 33 versions - [NSX Edge](https://www.precursorintelligence.com/product/vmware/nsx_edge): 2 vulnerabilities, 22 versions - [Airwatch Console](https://www.precursorintelligence.com/product/vmware/airwatch_console): 2 vulnerabilities, 23 versions - [Hyperic Hq](https://www.precursorintelligence.com/product/vmware/hyperic_hq): 2 vulnerabilities, 4 versions - [Open-VM-Tools](https://www.precursorintelligence.com/product/vmware/open-vm-tools): 2 vulnerabilities, 1 version - [Vmware Esxi](https://www.precursorintelligence.com/product/vmware/vmware_esxi): 2 vulnerabilities, 1 version - [Vmware Hcx](https://www.precursorintelligence.com/product/vmware/vmware_hcx): 2 vulnerabilities, 18 versions - [Pinniped](https://www.precursorintelligence.com/product/vmware/pinniped): 2 vulnerabilities, 25 versions - [Zimbra Desktop](https://www.precursorintelligence.com/product/vmware/zimbra_desktop): 1 vulnerability, 4 versions - [Airwatch Launcher](https://www.precursorintelligence.com/product/vmware/airwatch_launcher): 1 vulnerability, 1 version - [Capacityiq](https://www.precursorintelligence.com/product/vmware/capacityiq): 1 vulnerability, 8 versions - [Carbon Black Cloud](https://www.precursorintelligence.com/product/vmware/carbon_black_cloud): 1 vulnerability, 1 version - [Carbon Black Cloud Workload](https://www.precursorintelligence.com/product/vmware/carbon_black_cloud_workload): 1 vulnerability, 2 versions - [Cloud Foundation Operations](https://www.precursorintelligence.com/product/vmware/cloud_foundation_operations): 1 vulnerability, 1 version - [Greenplum Database](https://www.precursorintelligence.com/product/vmware/greenplum_database): 1 vulnerability, 147 versions - [Harbor Container Registry](https://www.precursorintelligence.com/product/vmware/harbor_container_registry): 1 vulnerability, 11 versions - [Horizon View Agent](https://www.precursorintelligence.com/product/vmware/horizon_view_agent): 1 vulnerability, 7 versions - [Horizon View Agents](https://www.precursorintelligence.com/product/vmware/horizon_view_agents): 1 vulnerability, 4 versions - [Hyperic Agent](https://www.precursorintelligence.com/product/vmware/hyperic_agent): 1 vulnerability, 4 versions - [I40en](https://www.precursorintelligence.com/product/vmware/i40en): 1 vulnerability, 1 version - [Intelligent Hub](https://www.precursorintelligence.com/product/vmware/intelligent_hub): 1 vulnerability, 29 versions - [Isolation Segment](https://www.precursorintelligence.com/product/vmware/isolation_segment): 1 vulnerability, 8 versions - [Lab Manager](https://www.precursorintelligence.com/product/vmware/lab_manager): 1 vulnerability, 1 version - [NSX](https://www.precursorintelligence.com/product/vmware/nsx): 1 vulnerability, 6 versions - [NSX SD-WAN by Velocloud](https://www.precursorintelligence.com/product/vmware/nsx_sd-wan_by_velocloud): 1 vulnerability, 3 versions - [NSX-V Edge](https://www.precursorintelligence.com/product/vmware/nsx-v_edge): 1 vulnerability, 25 versions - [Operations Manager](https://www.precursorintelligence.com/product/vmware/operations_manager): 1 vulnerability, 6 versions - [Ovf Tool](https://www.precursorintelligence.com/product/vmware/ovf_tool): 1 vulnerability, 5 versions - [Pivotal Scheduler](https://www.precursorintelligence.com/product/vmware/pivotal_scheduler): 1 vulnerability, 5 versions - [Pivotal Software Mysql](https://www.precursorintelligence.com/product/vmware/pivotal_software_mysql): 1 vulnerability, 14 versions - [SD-WAN by Velocloud](https://www.precursorintelligence.com/product/vmware/sd-wan_by_velocloud): 1 vulnerability, 8 versions - [SD-WAN Edge Firmware](https://www.precursorintelligence.com/product/vmware/sd-wan_edge_firmware): 1 vulnerability, 2 versions - [Single Sign-on for Tanzu](https://www.precursorintelligence.com/product/vmware/single_sign-on_for_tanzu): 1 vulnerability, 5 versions - [Spring Cloud Contract](https://www.precursorintelligence.com/product/vmware/spring_cloud_contract): 1 vulnerability, 18 versions - [Spring Cloud Netflix Zuul](https://www.precursorintelligence.com/product/vmware/spring_cloud_netflix_zuul): 1 vulnerability, 3 versions - [Spring Cloud SSO Connector](https://www.precursorintelligence.com/product/vmware/spring_cloud_sso_connector): 1 vulnerability, 6 versions - [Spring Cloud Task](https://www.precursorintelligence.com/product/vmware/spring_cloud_task): 1 vulnerability, 29 versions - [Spring Cloud Vault](https://www.precursorintelligence.com/product/vmware/spring_cloud_vault): 1 vulnerability, 36 versions - [Spring Data Mongodb](https://www.precursorintelligence.com/product/vmware/spring_data_mongodb): 1 vulnerability, 177 versions - [Spring for Apache Kafka](https://www.precursorintelligence.com/product/vmware/spring_for_apache_kafka): 1 vulnerability, 184 versions - [Spring for Graphql](https://www.precursorintelligence.com/product/vmware/spring_for_graphql): 1 vulnerability, 19 versions - [Spring Hateoas](https://www.precursorintelligence.com/product/vmware/spring_hateoas): 1 vulnerability, 80 versions - [Spring Session](https://www.precursorintelligence.com/product/vmware/spring_session): 1 vulnerability, 1 version - [Spring Social](https://www.precursorintelligence.com/product/vmware/spring_social): 1 vulnerability, 12 versions - [Stage Manager](https://www.precursorintelligence.com/product/vmware/stage_manager): 1 vulnerability, 1 version - [Tanzu Application Service for Vms](https://www.precursorintelligence.com/product/vmware/tanzu_application_service_for_vms): 1 vulnerability, 155 versions - [Thinapp](https://www.precursorintelligence.com/product/vmware/thinapp): 1 vulnerability, 11 versions - [Unified Access Gateway](https://www.precursorintelligence.com/product/vmware/unified_access_gateway): 1 vulnerability, 5 versions - [Vcenter Lab Manager](https://www.precursorintelligence.com/product/vmware/vcenter_lab_manager): 1 vulnerability, 4 versions ## Questions ### How many vulnerabilities does VMware have? Our catalogue lists 915 published vulnerabilities across 233 products and 5,164 versions from VMware. The most recent VMware flaw added to the known-exploited list is CVE-2021-22054, on 9 March 2026. ### Which VMware vulnerabilities are being exploited? 37 VMware vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2021-22054, CVE-2024-37079 and CVE-2025-41244. The full list is on this page. ### Which VMware product has the most vulnerabilities? Workstation, with 215 published vulnerabilities. Its own page lists the ones known to be exploited. ### How do I get alerts for new VMware vulnerabilities? Create a Precursor Intelligence account and track the VMware products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook. ## Running VMware? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact