Brand
VMware (Broadcom): actively exploited vulnerabilities
28 vulnerabilities in VMware (Broadcom) products (vCenter Server, ESXi, Workspace ONE Access / Identity Manager…) are in CISA’s catalog of exploited vulnerabilities, 1 of them added in the last 90 days. Last added: August 18, 2026.
The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).
-
4 vulnerabilities added in the last 12 months
-
28 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one VMware (Broadcom) category to your radar, or open its page.
- Virtualization, VDI and cloud 21 vulnerabilities
- Identity and access 3 vulnerabilities
- Monitoring, ITSM and asset management 3 vulnerabilities
- Switches, routers and SD-WAN 1 vulnerability
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
Follow a single VMware (Broadcom) product (vCenter Server, ESXi…) rather than the whole brand.
- vCenter Server12 vulnerabilities, Virtualization and VDI
- ESXi6 vulnerabilities, Virtualization and VDI
- Workspace ONE Access / Identity Manager3 vulnerabilities, Identity and access
- Aria Operations (ex-vRealize Operations)2 vulnerabilities, Monitoring and ITSM
- VMware Tools2 vulnerabilities, Virtualization and VDI
- Aria Operations for Networks (ex-vRealize Network Insight)1 vulnerability, Monitoring and ITSM
- SD-WAN (VeloCloud)1 vulnerability, Switches and routers
- Workstation / Fusion1 vulnerability, Virtualization and VDI
Names used by CISA: Broadcom, VMware. Product families: indicative classification by this site.
Pace of additions
| Period | Vulnerabilities added |
|---|---|
| Sep 9, 2025 to Oct 8, 2025 | 0 |
| Oct 9, 2025 to Nov 7, 2025 | 1 |
| Nov 8, 2025 to Dec 7, 2025 | 0 |
| Dec 8, 2025 to Jan 6, 2026 | 0 |
| Jan 7, 2026 to Feb 5, 2026 | 1 |
| Feb 6, 2026 to Mar 7, 2026 | 1 |
| Mar 8, 2026 to Apr 6, 2026 | 0 |
| Apr 7, 2026 to May 6, 2026 | 0 |
| May 7, 2026 to Jun 5, 2026 | 0 |
| Jun 6, 2026 to Jul 5, 2026 | 0 |
| Jul 6, 2026 to Aug 4, 2026 | 0 |
| Aug 5, 2026 to Sep 3, 2026 | 1 |
| Sep 4, 2026 to Oct 3, 2026 (in progress) | 0 |
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this VMware (Broadcom) list.
- Rank 1
VMware (Broadcom) vCenter ServerCVE-2026-59310
Broadcom VMware vCenter Path Traversal Vulnerability
Hunt for compromise (CISA)Ransomware
CVSS severity 9.8critical
Added Aug 18, 2026
- Rank 2
VMware (Broadcom) vCenter ServerCVE-2024-37079
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
CVE from 2024, added in 2026
CVSS severity 9.8critical
Added Jan 23, 2026
- Rank 3
VMware (Broadcom) Aria Operations (ex-vRealize Operations)CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability
CVSS severity 8.1high
Added Mar 3, 2026
- Rank 4
VMware (Broadcom) VMware ToolsCVE-2025-41244
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
CVSS severity 7.8high
Added Oct 30, 2025
- Rank 5
VMware (Broadcom) vCenter ServerCVE-2024-38812
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
CVSS severity 9.8critical
Added Nov 20, 2024
- Rank 6
VMware (Broadcom) vCenter ServerCVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability
CVSS severity 9.8critical
Added Nov 20, 2024
- Rank 7
VMware (Broadcom) vCenter ServerCVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
CVSS severity 9.8critical
Added Jan 22, 2024
- Rank 8
VMware (Broadcom) Aria Operations for Networks (ex-vRealize Network Insight)CVE-2023-20887
Vmware Aria Operations for Networks Command Injection Vulnerability
CVSS severity 9.8critical
Added Jun 22, 2023
- Rank 9
VMware (Broadcom) Workspace ONE Access / Identity ManagerCVE-2022-22954
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
Ransomware
CVSS severity 9.8critical
Added Apr 14, 2022
- Rank 10
VMware (Broadcom) ESXiCVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
RansomwareCVE from 2019, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Show 18 more vulnerabilities
- Rank 11
VMware (Broadcom) vCenter ServerCVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
CVSS severity 9.8critical
Added Nov 3, 2021
- Rank 12
VMware (Broadcom) ESXiCVE-2020-3992
VMware ESXi OpenSLP Use-After-Free Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 3, 2021
- Rank 13
VMware (Broadcom) vCenter ServerCVE-2021-21972
VMware vCenter Server Remote Code Execution Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 3, 2021
- Rank 14
VMware (Broadcom) vCenter ServerCVE-2021-21985
VMware vCenter Server Improper Input Validation Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 3, 2021
- Rank 15
VMware (Broadcom) vCenter ServerCVE-2021-22005
VMware vCenter Server File Upload Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 3, 2021
- Rank 16
VMware (Broadcom) Workspace ONE Access / Identity ManagerCVE-2020-4006
Multiple VMware Products Command Injection Vulnerability
CVSS severity 9.1critical
Added Nov 3, 2021
- Rank 17
VMware (Broadcom) ESXiCVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVSS severity 8.2high
Added Mar 4, 2025
- Rank 18
VMware (Broadcom) ESXiCVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
Ransomware
CVSS severity 8.2high
Added Mar 4, 2025
- Rank 19
VMware (Broadcom) SD-WAN (VeloCloud)CVE-2018-6961
VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
CVE from 2018, added in 2022
CVSS severity 8.1high
Added Mar 25, 2022
- Rank 20
VMware (Broadcom) Workspace ONE Access / Identity ManagerCVE-2022-22960
VMware Multiple Products Privilege Escalation Vulnerability
CVSS severity 7.8high
Added Apr 15, 2022
- Rank 21
VMware (Broadcom) Workstation / FusionCVE-2020-3950
VMware Multiple Products Privilege Escalation Vulnerability
CVSS severity 7.8high
Added Nov 3, 2021
- Rank 22
VMware (Broadcom) Aria Operations (ex-vRealize Operations)CVE-2021-21975
VMware Server Side Request Forgery in vRealize Operations Manager API
Ransomware
CVSS severity 7.5high
Added Jan 18, 2022
- Rank 23
VMware (Broadcom) ESXiCVE-2024-37085
VMware ESXi Authentication Bypass Vulnerability
Ransomware
CVSS severity 7.2high
Added Jul 30, 2024
- Rank 24
VMware (Broadcom) vCenter ServerCVE-2022-22948
VMware vCenter Server Incorrect Default File Permissions Vulnerability
CVE from 2022, added in 2024
CVSS severity 6.5medium
Added Jul 17, 2024
- Rank 25
VMware (Broadcom) ESXiCVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
CVSS severity 6.0medium
Added Mar 4, 2025
- Rank 26
VMware (Broadcom) vCenter ServerCVE-2021-21973
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
CVSS severity 5.3medium
Added Mar 7, 2022
- Rank 27
VMware (Broadcom) vCenter ServerCVE-2021-22017
VMware vCenter Server Improper Access Control
CVSS severity 5.3medium
Added Jan 10, 2022
- Rank 28
VMware (Broadcom) VMware ToolsCVE-2023-20867
VMware Tools Authentication Bypass Vulnerability
CVSS severity 3.9low
Added Jun 23, 2023
Follow and verify
Get new VMware (Broadcom) vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).
Indicative classification, based on the vendor and product names given by CISA. How products are classified.