Cloud Foundation (Vmware) - vulnerabilities (CVEs)

141 CVEs, 0 in the last 30 days, 84 known versions, newest CVE from 2026-07-30. Vendor: Vmware.

CVEs of Cloud Foundation

CVE-2026-41709 - CVSS 2.7 (low), 2026-07-30: VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being…
CVE-2026-41703 - CVSS 7.6 (high), 2026-07-30: VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an…
CVE-2026-47876 - CVSS 9.3 (critical), 2026-07-30: VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a…
CVE-2026-59309 - CVSS 9.8 (critical), 2026-07-30: VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit…
CVE-2026-59310 - CVSS 9.8 (critical), 2026-07-30: VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to…
CVE-2026-41724 - CVSS 8 (high), 2026-06-08: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views…
CVE-2026-41723 - CVSS 8 (high), 2026-06-08: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views…
CVE-2026-41722 - CVSS 8 (high), 2026-06-08: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views…
CVE-2026-22721 - CVSS 7.2 (high), 2026-02-25: VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this…
CVE-2026-22720 - CVSS 9 (critical), 2026-02-25: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to…
CVE-2026-22719 - CVSS 8.1 (high), 2026-02-25: VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands…
CVE-2025-41250 - CVSS 8.5 (high), 2025-09-29: VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create…
CVE-2025-41244 - CVSS 7.8 (high), 2025-09-29: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having…
CVE-2025-41241 - CVSS 4.4 (medium), 2025-07-29: VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for…
CVE-2025-41239 - CVSS 7.1 (high), 2025-07-15: VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A…
CVE-2025-41238 - CVSS 9.3 (critical), 2025-07-15: VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds…
CVE-2025-41237 - CVSS 9.3 (critical), 2025-07-15: VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A…
CVE-2025-41236 - CVSS 9.3 (critical), 2025-07-15: VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local…
CVE-2025-22245 - CVSS 5.9 (medium), 2025-06-04: VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.
CVE-2025-22244 - CVSS 6.9 (medium), 2025-06-04: VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.
CVE-2025-22243 - CVSS 7.5 (high), 2025-06-04: VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.
CVE-2025-41226 - CVSS 6.8 (medium), 2025-05-20: VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a…
CVE-2025-41225 - CVSS 8.8 (high), 2025-05-20: The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script…
CVE-2025-41228 - CVSS 4.3 (medium), 2025-05-20: VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access…
CVE-2025-41227 - CVSS 5.5 (medium), 2025-05-20: VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative…
CVE-2025-41231 - CVSS 7.3 (high), 2025-05-20: VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to…
CVE-2025-41229 - CVSS 8.2 (high), 2025-05-20: VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit…
CVE-2025-41230 - CVSS 7.5 (high), 2025-05-20: VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foundation may…
CVE-2025-22249 - CVSS 8.2 (high), 2025-05-13: VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a…
CVE-2025-22225 - CVSS 8.2 (high), 2025-03-04: VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading…
CVE-2025-22224 - CVSS 9.3 (critical), 2025-03-04: VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…
CVE-2025-22226 - CVSS 7.1 (high), 2025-03-04: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with…
CVE-2025-22221 - CVSS 5.2 (medium), 2025-01-30: VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for…
CVE-2025-22220 - CVSS 5.4 (medium), 2025-01-30: VMware Aria Operations for Logs contains a privilege escalation vulnerability. A malicious actor with non-administrative privileges and network access to Aria…
CVE-2025-22219 - CVSS 9 (critical), 2025-01-30: VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to…
CVE-2025-22222 - CVSS 7.7 (high), 2025-01-30: VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to…
CVE-2025-22218 - CVSS 8.5 (high), 2025-01-30: VMware Aria Operations for Logs contains an information disclosure vulnerability. A malicious actor with View Only Admin permissions may be able to read the…
CVE-2024-38831 - CVSS 7.8 (high), 2024-11-26: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious…
CVE-2024-38834 - CVSS 6.5 (medium), 2024-11-26: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject…
CVE-2024-38830 - CVSS 7.8 (high), 2024-11-26: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this…
CVE-2024-38833 - CVSS 6.8 (medium), 2024-11-26: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious…
CVE-2024-38832 - CVSS 7.1 (high), 2024-11-26: VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious…
CVE-2024-38817 - CVSS 6.7 (medium), 2024-10-09: VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to…
CVE-2024-38818 - CVSS 6.7 (medium), 2024-10-09: VMware NSX contains a local privilege escalation vulnerability. An authenticated malicious actor may exploit this vulnerability to obtain permissions from a…
CVE-2024-38815 - CVSS 4.3 (medium), 2024-10-09: VMware NSX contains a content spoofing vulnerability. An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker…
CVE-2024-38813 - CVSS 9.8 (critical), 2024-09-17: The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to…
CVE-2024-38812 - CVSS 9.8 (critical), 2024-09-17: The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter…
CVE-2024-22280 - CVSS 8.5 (high), 2024-07-11: VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter…
CVE-2024-37086 - CVSS 6.8 (medium), 2024-06-25: VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privileges on a virtual machine with an existing…
CVE-2024-37085 - CVSS 7.2 (high), 2024-06-25: VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an…
CVE-2024-37087 - CVSS 5.3 (medium), 2024-06-25: The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
CVE-2024-37080 - CVSS 9.8 (critical), 2024-06-18: vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server…
CVE-2024-37079 - CVSS 9.8 (critical), 2024-06-18: vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server…
CVE-2024-37081 - CVSS 7.8 (high), 2024-06-18: The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. An authenticated local user with…
CVE-2024-22275 - CVSS 4.9 (medium), 2024-05-21: The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit…
CVE-2024-22274 - CVSS 7.2 (high), 2024-05-21: The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance…
CVE-2024-22273 - CVSS 8.1 (high), 2024-05-21: The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual…
CVE-2024-22255 - CVSS 7.1 (high), 2024-03-05: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access…
CVE-2024-22254 - CVSS 8.2 (high), 2024-03-05: VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading…
CVE-2024-22253 - CVSS 9.3 (critical), 2024-03-05: VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges…
CVE-2024-22252 - CVSS 9.3 (critical), 2024-03-05: VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges…
CVE-2024-22235 - CVSS 6.7 (medium), 2024-02-21: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate…
CVE-2023-34063 - CVSS 9.9 (critical), 2024-01-16: Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized…
CVE-2023-34048 - CVSS 9.8 (critical), 2023-10-25: vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter…
CVE-2023-34043 - CVSS 6.7 (medium), 2023-09-27: VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate…
CVE-2023-20884 - CVSS 6.1 (medium), 2023-05-30: VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may be able to redirect…
CVE-2023-20878 - CVSS 7.2 (high), 2023-05-12: VMware Aria Operations contains a deserialization vulnerability. A malicious actor with administrative privileges can execute arbitrary commands and disrupt…
CVE-2023-20877 - CVSS 8.8 (high), 2023-05-12: VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly privileges can perform code execution…
CVE-2023-20880 - CVSS 6.7 (medium), 2023-05-12: VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges…
CVE-2023-20879 - CVSS 6.7 (medium), 2023-05-12: VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations…
CVE-2023-20865 - CVSS 7.2 (high), 2023-04-20: VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for…
CVE-2023-20864 - CVSS 9.8 (critical), 2023-04-20: VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations…
CVE-2022-31701 - CVSS 5.3 (medium), 2022-12-14: VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the…
CVE-2022-31700 - CVSS 7.2 (high), 2022-12-14: VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue…
CVE-2022-31698 - CVSS 5.3 (medium), 2022-12-13: The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter…
CVE-2022-31697 - CVSS 5.5 (medium), 2022-12-13: The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a…
CVE-2022-31696 - CVSS 8.8 (high), 2022-12-13: VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may…
CVE-2022-31699 - CVSS 3.3 (low), 2022-12-13: VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to…
CVE-2022-31678 - CVSS 9.1 (critical), 2022-10-28: VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to…
CVE-2022-31681 - CVSS 6.5 (medium), 2022-10-07: VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service…
CVE-2022-22982 - CVSS 7.5 (high), 2022-07-13: The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit…
CVE-2022-22973 - CVSS 7.8 (high), 2022-05-20: VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to…
CVE-2022-22972 - CVSS 9.8 (critical), 2022-05-20: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious…
CVE-2022-22960 - CVSS 7.8 (high), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support…
CVE-2022-22959 - CVSS 4.3 (medium), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user…
CVE-2022-22958 - CVSS 7.2 (high), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A…
CVE-2022-22961 - CVSS 5.3 (medium), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A…
CVE-2022-22957 - CVSS 7.2 (high), 2022-04-13: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A…
CVE-2022-22954 - CVSS 9.8 (critical), 2022-04-11: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with…
CVE-2022-22948 - CVSS 6.5 (medium), 2022-03-29: The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to…
CVE-2022-22945 - CVSS 7.8 (high), 2022-02-16: VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the…
CVE-2021-22040 - CVSS 6.7 (medium), 2022-02-16: VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges…
CVE-2021-22050 - CVSS 7.5 (high), 2022-02-16: ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a…
CVE-2021-22042 - CVSS 7.8 (high), 2022-02-16: VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges…
CVE-2021-22041 - CVSS 6.7 (medium), 2022-02-16: VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges…
CVE-2022-22939 - CVSS 4.9 (medium), 2022-02-04: VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC…
CVE-2021-22045 - CVSS 7.8 (high), 2022-01-04: VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a…
CVE-2021-21980 - CVSS 7.5 (high), 2021-11-24: The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter…
CVE-2021-22048 - CVSS 8.8 (high), 2021-11-10: The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor…
CVE-2021-22033 - CVSS 2.7 (low), 2021-10-13: Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.