VMware Cloud Foundation

13 known vulnerabilities in VMware Cloud Foundation, 6 critical, 13 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2026-59310 CVSS 9.8 critical · actively exploited Broadcom VMware vCenter Path Traversal Vulnerability
  • CVE-2025-41244 CVSS 7.8 high · actively exploited Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
  • CVE-2025-22226 CVSS 6.0 medium · actively exploited VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
  • CVE-2025-22225 CVSS 8.2 high · actively exploited VMware ESXi Arbitrary Write Vulnerability
  • CVE-2025-22224 CVSS 8.2 high · actively exploited VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
  • CVE-2024-38813 CVSS 9.8 critical · actively exploited VMware vCenter Server Privilege Escalation Vulnerability
  • CVE-2024-38812 CVSS 9.8 critical · actively exploited VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
  • CVE-2024-37085 CVSS 7.2 high · actively exploited VMware ESXi Authentication Bypass Vulnerability
  • CVE-2024-37079 CVSS 9.8 critical · actively exploited Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
  • CVE-2023-34048 CVSS 9.8 critical · actively exploited VMware vCenter Server Out-of-Bounds Write Vulnerability

Latest vulnerabilities

  • CVE-2026-59310 CVSS 9.8 critical · actively exploited Broadcom VMware vCenter Path Traversal Vulnerability
  • CVE-2025-41244 CVSS 7.8 high · actively exploited Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
  • CVE-2025-22226 CVSS 6.0 medium · actively exploited VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
  • CVE-2025-22225 CVSS 8.2 high · actively exploited VMware ESXi Arbitrary Write Vulnerability
  • CVE-2025-22224 CVSS 8.2 high · actively exploited VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
  • CVE-2024-38813 CVSS 9.8 critical · actively exploited VMware vCenter Server Privilege Escalation Vulnerability
  • CVE-2024-38812 CVSS 9.8 critical · actively exploited VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
  • CVE-2024-37085 CVSS 7.2 high · actively exploited VMware ESXi Authentication Bypass Vulnerability
  • CVE-2024-37079 CVSS 9.8 critical · actively exploited Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
  • CVE-2023-34048 CVSS 9.8 critical · actively exploited VMware vCenter Server Out-of-Bounds Write Vulnerability
  • CVE-2022-22948 CVSS 6.5 medium · actively exploited VMware vCenter Server Incorrect Default File Permissions Vulnerability
  • CVE-2021-21973 CVSS 5.3 medium · actively exploited VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability
  • CVE-2021-21972 CVSS 9.8 critical · actively exploited VMware vCenter Server Remote Code Execution Vulnerability