Virtualization, VDI and cloud

Hypervisors, virtualization consoles, virtual desktops (VDI) and vendors’ cloud services.

For example: VMware ESXi, vCenter, Hyper-V, Citrix Virtual Apps.

Category RSS feed

3 vulnerabilities added in the last 12 months
35 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

Affected brands

In alphabetical order, with their number of vulnerabilities in this category.

Cisco 2 vulnerabilities
Citrix 4 vulnerabilities
Microsoft 7 vulnerabilities
Oracle 1 vulnerability
VMware (Broadcom) 21 vulnerabilities · 3 in the last 12 months

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this category.

Rank 1VMware (Broadcom) vCenter Server
CVE-2026-59310
Hunt for compromise (CISA)Ransomware
Broadcom VMware vCenter Path Traversal Vulnerability
Added in the last 12 months: ranked by severity.
Added
Aug 18, 2026
CISA deadline
3 days
CVSS severity
9.8 (critical)
Rank 2VMware (Broadcom) vCenter Server
CVE-2024-37079
CVE from 2024, added in 2026
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Added in the last 12 months: ranked by severity.
Added
Jan 23, 2026
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 3VMware (Broadcom) VMware Tools
CVE-2025-41244
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Added in the last 12 months: ranked by severity.
Added
Oct 30, 2025
CISA deadline
21 days
CVSS severity
7.8 (high)
Rank 4Microsoft Partner Center
CVE-2024-49035
Microsoft Partner Center Improper Access Control Vulnerability
Added more than a year ago: ranked by severity.
Added
Feb 25, 2025
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 5Microsoft Power Pages
CVE-2025-24989
Microsoft Power Pages Improper Access Control Vulnerability
Added more than a year ago: ranked by severity.
Added
Feb 21, 2025
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 6VMware (Broadcom) vCenter Server
CVE-2024-38812
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 20, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 7VMware (Broadcom) vCenter Server
CVE-2024-38813
VMware vCenter Server Privilege Escalation Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 20, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 8VMware (Broadcom) vCenter Server
CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
Added more than a year ago: ranked by severity.
Added
Jan 22, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 9Citrix Workspace app / Receiver
CVE-2019-11634
RansomwareCVE from 2019, added in 2021
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 10VMware (Broadcom) ESXi
CVE-2019-5544
RansomwareCVE from 2019, added in 2021
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)

Show 25 more vulnerabilities

Rank 11VMware (Broadcom) vCenter Server
CVE-2020-3952
VMware vCenter Server Information Disclosure Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 12VMware (Broadcom) ESXi
CVE-2020-3992
Ransomware
VMware ESXi OpenSLP Use-After-Free Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 13Cisco HyperFlex HX
CVE-2021-1497
Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 14Cisco HyperFlex HX
CVE-2021-1498
Cisco HyperFlex HX Data Platform Command Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 15VMware (Broadcom) vCenter Server
CVE-2021-21972
Ransomware
VMware vCenter Server Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 16VMware (Broadcom) vCenter Server
CVE-2021-21985
Ransomware
VMware vCenter Server Improper Input Validation Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 17VMware (Broadcom) vCenter Server
CVE-2021-22005
Ransomware
VMware vCenter Server File Upload Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 18Microsoft Open Management Infrastructure (OMI)
CVE-2021-38647
Ransomware
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
9.8 (critical)
Rank 19Microsoft Hyper-V
CVE-2020-1040
Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.0 (critical)
Rank 20Oracle VirtualBox
CVE-2008-3431
CVE from 2008, added in 2022
Oracle VirtualBox Insufficient Input Validation Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 3, 2022
CISA deadline
21 days
CVSS severity
8.8 (high)
Rank 21VMware (Broadcom) ESXi
CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 4, 2025
CISA deadline
21 days
CVSS severity
8.2 (high)
Rank 22VMware (Broadcom) ESXi
CVE-2025-22225
Ransomware
VMware ESXi Arbitrary Write Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 4, 2025
CISA deadline
21 days
CVSS severity
8.2 (high)
Rank 23Citrix Session Recording
CVE-2024-8068
Citrix Session Recording Improper Privilege Management Vulnerability
Added more than a year ago: ranked by severity.
Added
Aug 25, 2025
CISA deadline
21 days
CVSS severity
8.0 (high)
Rank 24Citrix Session Recording
CVE-2024-8069
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
Added more than a year ago: ranked by severity.
Added
Aug 25, 2025
CISA deadline
21 days
CVSS severity
8.0 (high)
Rank 25VMware (Broadcom) Workstation / Fusion
CVE-2020-3950
VMware Multiple Products Privilege Escalation Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
7.8 (high)
Rank 26Microsoft Open Management Infrastructure (OMI)
CVE-2021-38645
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
7.8 (high)
Rank 27Microsoft Open Management Infrastructure (OMI)
CVE-2021-38648
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
7.8 (high)
Rank 28Microsoft Open Management Infrastructure (OMI)
CVE-2021-38649
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
14 days
CVSS severity
7.8 (high)
Rank 29Citrix StoreFront
CVE-2019-13608
RansomwareCVE from 2019, added in 2021
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
7.5 (high)
Rank 30VMware (Broadcom) ESXi
CVE-2024-37085
Ransomware
VMware ESXi Authentication Bypass Vulnerability
Added more than a year ago: ranked by severity.
Added
Jul 30, 2024
CISA deadline
21 days
CVSS severity
7.2 (high)
Rank 31VMware (Broadcom) vCenter Server
CVE-2022-22948
CVE from 2022, added in 2024
VMware vCenter Server Incorrect Default File Permissions Vulnerability
Added more than a year ago: ranked by severity.
Added
Jul 17, 2024
CISA deadline
21 days
CVSS severity
6.5 (medium)
Rank 32VMware (Broadcom) ESXi
CVE-2025-22226
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 4, 2025
CISA deadline
21 days
CVSS severity
6.0 (medium)
Rank 33VMware (Broadcom) vCenter Server
CVE-2021-21973
VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 7, 2022
CISA deadline
14 days
CVSS severity
5.3 (medium)
Rank 34VMware (Broadcom) vCenter Server
CVE-2021-22017
VMware vCenter Server Improper Access Control
Added more than a year ago: ranked by severity.
Added
Jan 10, 2022
CISA deadline
14 days
CVSS severity
5.3 (medium)
Rank 35VMware (Broadcom) VMware Tools
CVE-2023-20867
VMware Tools Authentication Bypass Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 23, 2023
CISA deadline
21 days
CVSS severity
3.9 (low)

Filed under another category

These 4 vulnerabilities also concern this type of product, but are counted in their main category. My radar finds them when you follow this category.

Microsoft Windows
CVE-2025-21333
Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability
Added more than a year ago: ranked by severity.
Added
Jan 14, 2025
CISA deadline
21 days
CVSS severity
7.8 (high)
Microsoft Windows
CVE-2025-21334
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Added more than a year ago: ranked by severity.
Added
Jan 14, 2025
CISA deadline
21 days
CVSS severity
7.8 (high)
Microsoft Windows
CVE-2025-21335
Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability
Added more than a year ago: ranked by severity.
Added
Jan 14, 2025
CISA deadline
21 days
CVSS severity
7.8 (high)
Microsoft Windows
CVE-2024-38080
Microsoft Windows Hyper-V Privilege Escalation Vulnerability
Added more than a year ago: ranked by severity.
Added
Jul 9, 2024
CISA deadline
21 days
CVSS severity
7.8 (high)

Get new vulnerabilities in this category: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

Affected brands

See also

Patch first

Filed under another category

Follow and verify