What’s Vulnerable › Products
VMware ESXi vulnerabilities
146 known vulnerabilities, 8 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.
Check whether your VMware ESXi version is affected
Exploited VMware ESXi vulnerabilities
- CVE-2025-22226 — VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
- CVE-2025-22225 — VMware ESXi Arbitrary Write Vulnerability
- CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
- CVE-2024-37085 — VMware ESXi Authentication Bypass Vulnerability
- CVE-2023-29552 — Service Location Protocol (SLP) Denial-of-Service Vulnerability
- CVE-2010-3904 — Linux Kernel Improper Input Validation Vulnerability
- CVE-2020-3992 — VMware ESXi OpenSLP Use-After-Free Vulnerability
- CVE-2019-5544 — VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
Latest VMware ESXi vulnerabilities
- CVE-2025-41239 — vSockets information-disclosure vulnerability (CVSS 7.1)
- CVE-2025-41238 — PVSCSI heap-overflow vulnerability (CVSS 9.3)
- CVE-2025-41237 — VMCI integer-underflow vulnerability (CVSS 9.3)
- CVE-2025-41236 — VMXNET3 integer-overflow vulnerability (CVSS 9.3)
- CVE-2025-41228 — VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 4.3)
- CVE-2025-41227 — Denial-of-Service Vulnerability (CVSS 5.5)
- CVE-2025-41226 — Guest Operations Denial-of-Service Vulnerability (CVSS 6.8)
- CVE-2025-22226 — VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability (CVSS 6.0) — exploited
- CVE-2025-22225 — VMware ESXi Arbitrary Write Vulnerability (CVSS 8.2) — exploited
- CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability (CVSS 8.2) — exploited
- CVE-2024-37086 — (CVSS 6.8)
- CVE-2024-37085 — VMware ESXi Authentication Bypass Vulnerability (CVSS 7.2) — exploited
- CVE-2024-22273 — (CVSS 7.8)
- CVE-2024-22255 — Information disclosure vulnerability (CVSS 7.1)
- CVE-2024-22254 — Out-of-bounds write vulnerability (CVSS 8.2)
- CVE-2024-22253 — Use-after-free vulnerability (CVSS 6.7)
- CVE-2024-22252 — Use-after-free vulnerability (CVSS 6.7)
- CVE-2023-29552 — Service Location Protocol (SLP) Denial-of-Service Vulnerability (CVSS 7.5) — exploited
- CVE-2022-31705 — (CVSS 8.2)
- CVE-2022-31699 — (CVSS 3.3)
- CVE-2022-31696 — (CVSS 8.8)
- CVE-2022-31681 — (CVSS 6.5)
- CVE-2022-23825 — (CVSS 6.5)
- CVE-2022-29901 — Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed) (CVSS 6.5)
- CVE-2022-21166 — (CVSS 5.5)