What is the vmware CNA?

vmware is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 613 CVE records since 2016.

How many CVEs has vmware published?

vmware has published 613 CVE records, including 150 in the last two years.

What is vmware's CVE data quality grade?

RadicalNotion.AI grades vmware's CVE data quality as F, with an overall completeness score of 54.1%. This reflects how consistently its CVE records include vendor (41.9%), product (97.7%), CVSS (32.5%), and CWE (44.2%) information.

What products does vmware publish CVEs for?

vmware most frequently publishes CVEs for Cloud Foundation, Workstation, Fusion, ESXi, vCenter Server.

Which vendors does vmware cover?

vmware publishes CVEs across 14 distinct vendors, most often VMware, Inc., Spring, spring-projects, microsoft, apple.

Is vmware actively publishing CVEs?

vmware is currently active, based on 150 CVEs in the last two years.

What is the average severity of vmware's CVEs?

The average CVSS base score across vmware's scored CVEs is 6.8.

How many critical CVEs has vmware published?

vmware has published 111 critical-severity CVEs and 358 high-severity CVEs.

Are any of vmware's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 31 of vmware's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in vmware's CVEs?

vmware's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-269 (Improper Privilege Management).

How does vmware rank among CNAs?

By total CVE volume, vmware ranks #50 of 370 CNAs, and it reports more complete CVE records than 9% of all CNAs.

Grade F

Active

vmware

Name: vmware CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published January 30, 2026

613

CVEs published

Total assigned

9.1

Years active

2016–2026

6.8

Avg CVSS

Across scored CVEs

150

Recent CVEs

Last 2 years

Overview

vmware is a CVE Numbering Authority that has published 613 CVE records since 2016. It is currently classified as active, with 150 CVEs published in the last two years. Its CVE data quality is graded F (54.1% overall completeness).

Among the 370 CNAs tracked here, vmware ranks #50 by CVE volume and reports more complete records than 9% of all CNAs.

Data quality report card

How complete and consistent vmware's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often vmware also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

54.1%

Overall score

Overall completeness54.1%

Vendor completeness41.9%

Product completeness97.7%

CVSS completeness32.5%

CWE completeness44.2%

100%

Update rate

Records revised after publishing

Vendor diversity

Distinct vendors covered

334 chars

Avg description length

Per CVE record

2016-12-29

First CVE date

Earliest assignment

2026-01-30

Latest CVE date

Most recent assignment

6.8

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of vmware's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical111

High358

Medium285

Low22

In CISA’s Known Exploited Vulnerabilities catalog

31 of vmware's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories vmware most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs vmware has published each year.

2019

2020

2021

2022

2023

2024

2025

2026

167

12-month change

How vmware's CVE data quality has shifted over the trailing year.

Previous grade

Current grade

Score change

39.7% → 73.5% (+33.8%)

Improved most in CVSS Completeness (+80.4 pts)

Top vendors

The vendors vmware publishes the most CVEs for.

VMware, Inc.643 CVEs
Spring141 CVEs
spring-projects102 CVEs
microsoft49 CVEs
apple49 CVEs
Cloud Foundry40 CVEs
linux39 CVEs
Broadcom20 CVEs

Latest CVEs

The most recent CVEs assigned by vmware.

CVE-2026-47871CWE-22
VMware Avi Load Balancer Directory Traversal Vulnerability
High · CVSS 8.8
EPSS 0.9%2026-07-18
CVE-2026-47870CWE-269
VMware Avi Load Balancer Privilege Escalation Vulnerability
High · CVSS 7.1
EPSS 0.4%2026-07-18
CVE-2026-47869CWE-94
VMware Avi Load Balancer Remote Code Execution Vulnerability
High · CVSS 8.7
EPSS 0.7%2026-07-18
CVE-2026-47868CWE-269
VMware Avi Load Balancer Local Privilege Escalation Vulnerability
High · CVSS 7.8
EPSS 0.1%2026-07-18
CVE-2026-47867CWE-94
VMware Avi Load Balancer Remote Code Execution Vulnerability
High · CVSS 8.7
EPSS 0.7%2026-07-18
CVE-2026-47866CWE-863
VMware Avi Load Balancer Authorization Bypass Vulnerability
High · CVSS 8.3
EPSS 0.4%2026-07-18
CVE-2026-47865CWE-287
VMware Avi Load Balancer Authentication Bypass Vulnerability
Critical · CVSS 9.8
EPSS 0.7%2026-07-18
CVE-2026-22752
Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata
Critical · CVSS 9.6
EPSS 0.4%2026-07-16
CVE-2026-59269
Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries
Low · CVSS 3.8
EPSS 0.2%2026-07-09
CVE-2026-47840
LDAP StartTLS unconditionally disables hostname verification
High · CVSS 8.3
EPSS 0.1%2026-07-09
CVE-2026-47831
Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks
High · CVSS 7.7
EPSS 0.2%2026-07-09
CVE-2026-47830
Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite
High · CVSS 8.5
EPSS 0.1%2026-07-09

Track new vmware CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor vmware CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the vmware CNA.

What is the vmware CNA?: vmware is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 613 CVE records since 2016.
How many CVEs has vmware published?: vmware has published 613 CVE records, including 150 in the last two years.
What is vmware's CVE data quality grade?: RadicalNotion.AI grades vmware's CVE data quality as F, with an overall completeness score of 54.1%. This reflects how consistently its CVE records include vendor (41.9%), product (97.7%), CVSS (32.5%), and CWE (44.2%) information.
What products does vmware publish CVEs for?: vmware most frequently publishes CVEs for Cloud Foundation, Workstation, Fusion, ESXi, vCenter Server.
Which vendors does vmware cover?: vmware publishes CVEs across 14 distinct vendors, most often VMware, Inc., Spring, spring-projects, microsoft, apple.
Is vmware actively publishing CVEs?: vmware is currently active, based on 150 CVEs in the last two years.
What is the average severity of vmware's CVEs?: The average CVSS base score across vmware's scored CVEs is 6.8.
How many critical CVEs has vmware published?: vmware has published 111 critical-severity CVEs and 358 high-severity CVEs.
Are any of vmware's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 31 of vmware's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in vmware's CVEs?: vmware's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-269 (Improper Privilege Management).
How does vmware rank among CNAs?: By total CVE volume, vmware ranks #50 of 370 CNAs, and it reports more complete CVE records than 9% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track vmware CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing