What’s Vulnerable › Products

VMware Cloud Foundation vulnerabilities

153 known vulnerabilities, 19 confirmed exploited in the wild (CISA KEV), 40 published in the last 12 months.

Check whether your VMware Cloud Foundation version is affected

Exploited VMware Cloud Foundation vulnerabilities

CVE-2026-22719 — Broadcom VMware Aria Operations Command Injection Vulnerability
CVE-2024-37079 — Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
CVE-2025-41244 — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
CVE-2025-22226 — VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
CVE-2025-22225 — VMware ESXi Arbitrary Write Vulnerability
CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2024-38813 — VMware vCenter Server Privilege Escalation Vulnerability
CVE-2024-38812 — VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
CVE-2024-37085 — VMware ESXi Authentication Bypass Vulnerability
CVE-2022-22948 — VMware vCenter Server Incorrect Default File Permissions Vulnerability
CVE-2022-22960 — VMware Multiple Products Privilege Escalation Vulnerability
CVE-2022-22954 — VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
CVE-2021-21973 — VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
CVE-2021-21975 — VMware Server Side Request Forgery in vRealize Operations Manager API
CVE-2021-22005 — VMware vCenter Server File Upload Vulnerability
CVE-2021-21985 — VMware vCenter Server Improper Input Validation Vulnerability
CVE-2021-21972 — VMware vCenter Server Remote Code Execution Vulnerability
CVE-2020-4006 — Multiple VMware Products Command Injection Vulnerability
CVE-2020-3992 — VMware ESXi OpenSLP Use-After-Free Vulnerability

Latest VMware Cloud Foundation vulnerabilities

CVE-2026-41709 — ESX insufficient logging vulnerability (CVSS 2.7)
CVE-2026-47876 — VMXNET3 out-of-bounds write vulnerability (CVSS 9.3)
CVE-2026-41703 — Out-of-bounds read vulnerability (CVSS 7.6)
CVE-2026-41724 — VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) (CVSS 5.4)
CVE-2026-41723 — VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) (CVSS 8.0)
CVE-2026-41722 — VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) (CVSS 5.4)
CVE-2026-22721 — VMware Aria Operations privilege escalation vulnerability (CVSS 7.2)
CVE-2026-22720 — VMware Aria Operations stored cross-site scripting vulnerability (CVSS 9.0)
CVE-2026-22719 — Broadcom VMware Aria Operations Command Injection Vulnerability (CVSS 8.1) — exploited
CVE-2025-41250 — Header injection vulnerability (CVSS 8.5)
CVE-2025-41244 — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability (CVSS 7.8) — exploited
CVE-2025-41241 — Denial-of-service vulnerability (CVSS 4.4)
CVE-2025-41239 — vSockets information-disclosure vulnerability (CVSS 7.1)
CVE-2025-41238 — PVSCSI heap-overflow vulnerability (CVSS 9.3)
CVE-2025-41237 — VMCI integer-underflow vulnerability (CVSS 9.3)
CVE-2025-41236 — VMXNET3 integer-overflow vulnerability (CVSS 9.3)
CVE-2025-22245 — (CVSS 5.9)
CVE-2025-22244 — (CVSS 6.9)
CVE-2025-22243 — (CVSS 7.5)
CVE-2025-41228 — VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 4.3)
CVE-2025-41227 — Denial-of-Service Vulnerability (CVSS 5.5)
CVE-2025-41226 — Guest Operations Denial-of-Service Vulnerability (CVSS 6.8)
CVE-2025-41225 — VMware vCenter Server authenticated command-execution vulnerability (CVSS 8.8)
CVE-2025-41231 — VMware Cloud Foundation Missing Authorisation Vulnerability (CVSS 7.3)
CVE-2025-41230 — VMware Cloud Foundation Information Disclosure Vulnerability (CVSS 7.5)