VMware
- Exploited flaws
- 26in 14 products
- Added to CISA's list in 2026
- 03 in 2025
- Used by ransomware
- 9of 26, says CISA
- Disclosure to CISA's list
- 49 daysmedian; 8 of 18 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2018 | 1 |
| 2019 | 1 |
| 2020 | 4 |
| 2021 | 6 |
| 2022 | 5 |
| 2023 | 3 |
| 2024 | 3 |
| 2025 | 3 |
| 2026 | 0 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| vCenter Server | 9 | 2021-11-03 | 2024-11-20 |
| ESXi | 3 | 2021-11-03 | 2025-03-04 |
| Multiple Products | 3 | 2021-11-03 | 2022-04-15 |
Latest on CISA's list
- VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
- VMware ESXi Arbitrary Write Vulnerability
- VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
- VMware vCenter Server Privilege Escalation Vulnerability
- VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
- VMware ESXi Authentication Bypass Vulnerability
- VMware vCenter Server Incorrect Default File Permissions Vulnerability
- VMware vCenter Server Out-of-Bounds Write Vulnerability
- VMware Tools Authentication Bypass Vulnerability
- Vmware Aria Operations for Networks Command Injection Vulnerability
In the news
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.