How many vmware vsphere CVEs are in CISA KEV?

None of vmware vsphere's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for vmware vsphere vulnerabilities?

Yes — 1 of vmware vsphere's CVEs have a known public exploit.

Which versions of vmware vsphere are affected?

5 distinct vmware vsphere versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vmware vsphere CVEs?

vmware vsphere's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-190 (Integer Overflow or Wraparound), CWE-20 (Improper Input Validation), CWE-125 (Out-of-bounds Read).

What is the average severity of vmware vsphere CVEs?

The average CVSS base score across vmware vsphere's scored CVEs is 7.0.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Vmware
Vsphere

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Vmware
Vsphere

vmware vsphere Vulnerabilities: CVEs, CISA KEV & Security Advisories

vmware

63 CVEs

vmware vsphere Vulnerabilities

Name: vmware vsphere vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for vsphere by vmware.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

7.0

Avg CVSS

2012–2026

Last updated June 8, 2026

Overview

vmware vsphere has 63 published CVE records since 2012, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

Severity and exploitation

How the CVSS severity of vmware vsphere's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High44

Medium19

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of vmware vsphere's CVEs are currently listed in CISA's KEV catalog.

Public exploits

One of vmware vsphere's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every vmware vsphere version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

9.0 <= v < 9.0.2.02 CVEs
9.1 <= v <= 9.12 CVEs
<= 4.11 CVE
<= 5.01 CVE

Fixed in

9.0.2.02 CVEs

Find a version

63 CVEs

Sort

VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
CVE-2026-41723
Patch
CWE-79
High · CVSS 8.0
EPSS 0.4% (35th pct)2026-06-08
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
CVE-2026-41722
Patch
CWE-79
High · CVSS 8.0
EPSS 0.3% (23th pct)2026-06-08
Medium vulnerability · 2024-06-13
CVE-2024-0086
Patch
CWE-476
Medium · CVSS 5.5
EPSS 0.1% (4th pct)2024-06-13
CVE
CVE-2024-0085
Patch
CWE-266
High · CVSS 7.8
EPSS 0.1% (2th pct)2024-06-13
High vulnerability · 2024-06-13
CVE-2024-0084
Patch
CWE-250
High · CVSS 7.8
EPSS 0.2% (13th pct)2024-06-13
Medium vulnerability · 2024-06-13
CVE-2024-0092
Patch
CWE-703
Medium · CVSS 5.5
EPSS 0.2% (8th pct)2024-06-13
Medium vulnerability · 2024-06-13
CVE-2024-0093
Patch
CWE-200
Medium · CVSS 6.5
EPSS 0.2% (9th pct)2024-06-13
High vulnerability · 2024-06-13
CVE-2024-0091
Patch
CWE-822
High · CVSS 7.8
EPSS 0.2% (14th pct)2024-06-13
High vulnerability · 2024-06-13
CVE-2024-0090
Patch
CWE-787
High · CVSS 7.8
EPSS 0.3% (18th pct)2024-06-13
Medium vulnerability · 2023-11-02
CVE-2023-31026
Patch
CWE-476
Medium · CVSS 6.0
EPSS 0.2% (6th pct)2023-11-02
Medium vulnerability · 2023-11-02
CVE-2023-31022
Patch
CWE-476
Medium · CVSS 5.5
EPSS 0.2% (10th pct)2023-11-02
Medium vulnerability · 2023-11-02
CVE-2023-31021
Patch
CWE-476
Medium · CVSS 5.5
EPSS 0.2% (6th pct)2023-11-02
CVE
CVE-2023-31018
Patch
CWE-476
Medium · CVSS 6.5
EPSS 0.2% (9th pct)2023-11-02
High vulnerability · 2023-07-03
CVE-2023-25517
Patch
CWE-285
High · CVSS 7.1
EPSS 0.2% (5th pct)2023-07-03
High vulnerability · 2023-04-01
CVE-2023-0198
Patch
CWE-119
High · CVSS 7.8
EPSS 0.3% (15th pct)2023-04-01
Medium vulnerability · 2023-04-01
CVE-2023-0197
Patch
CWE-476
Medium · CVSS 6.5
EPSS 0.2% (6th pct)2023-04-01
High vulnerability · 2023-04-01
CVE-2023-0192
Patch
CWE-269
High · CVSS 7.8
EPSS 0.1% (3th pct)2023-04-01
High vulnerability · 2023-04-01
CVE-2023-0191
Patch
CWE-119
High · CVSS 7.1
EPSS 0.2% (14th pct)2023-04-01
Medium vulnerability · 2023-04-01
CVE-2023-0188
Patch
CWE-119
Medium · CVSS 5.5
EPSS 0.2% (13th pct)2023-04-01
High vulnerability · 2023-04-01
CVE-2023-0185
Patch
CWE-196
High · CVSS 7.1
EPSS 0.2% (11th pct)2023-04-01
High vulnerability · 2023-04-01
CVE-2023-0183
Patch
CWE-787
High · CVSS 7.1
EPSS 0.2% (14th pct)2023-04-01
High vulnerability · 2023-04-01
CVE-2023-0181
Patch
CWE-280
High · CVSS 7.1
EPSS 0.2% (10th pct)2023-04-01
High vulnerability · 2023-04-01
CVE-2023-0180
Patch
CWE-125
High · CVSS 7.1
EPSS 0.2% (15th pct)2023-04-01
High vulnerability · 2022-12-30
CVE-2022-42264
Patch
CWE-823
High · CVSS 7.8
EPSS 0.3% (18th pct)2022-12-30
High vulnerability · 2022-12-30
CVE-2022-42263
Patch
CWE-190
High · CVSS 7.1
EPSS 0.3% (17th pct)2022-12-30
High vulnerability · 2022-12-30
CVE-2022-42262
Patch
CWE-787
High · CVSS 7.8
EPSS 0.2% (13th pct)2022-12-30
High vulnerability · 2022-12-30
CVE-2022-42261
Patch
CWE-120
High · CVSS 7.8
EPSS 0.3% (18th pct)2022-12-30
High vulnerability · 2022-12-30
CVE-2022-42260
Patch
CWE-281
High · CVSS 7.8
EPSS 0.3% (15th pct)2022-12-30
Medium vulnerability · 2022-12-30
CVE-2022-42259
Patch
CWE-190
Medium · CVSS 5.5
EPSS 0.3% (18th pct)2022-12-30
High vulnerability · 2022-12-30
CVE-2022-42258
Patch
CWE-190
High · CVSS 7.3
EPSS 0.3% (19th pct)2022-12-30

Showing 30 of 63

Common weakness types

The CWE weakness categories most often found in vmware vsphere CVEs. Follow any weakness for its full explanation.

CWE-476NULL Pointer Dereference10 CVEs
CWE-190Integer Overflow or Wraparound6 CVEs
CWE-20Improper Input Validation6 CVEs
CWE-125Out-of-bounds Read5 CVEs
CWE-1284Improper Validation of Specified Quantity in Input5 CVEs
CWE-787

Disclosure activity by year

How many vmware vsphere CVEs were published each year.

2012

2020

2021

2022

2023

2024

2026

Other vmware products

Browse vulnerabilities for other products by vmware.

workstation230 CVEs cloud foundation158 CVEs esxi146 CVEs fusion138 CVEs spring framework91 CVEs esx89 CVEs player89 CVEs vcenter server83 CVEs

All vmware vulnerabilities

Frequently asked questions

Common questions about vmware vsphere vulnerabilities.

How many CVEs does vmware vsphere have?: vmware vsphere has 63 published CVE records since 2012.
How many vmware vsphere CVEs are in CISA KEV?: None of vmware vsphere's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for vmware vsphere vulnerabilities?: Yes — 1 of vmware vsphere's CVEs have a known public exploit.
Which versions of vmware vsphere are affected?: 5 distinct vmware vsphere versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in vmware vsphere CVEs?: vmware vsphere's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-190 (Integer Overflow or Wraparound), CWE-20 (Improper Input Validation), CWE-125 (Out-of-bounds Read).
What is the average severity of vmware vsphere CVEs?: The average CVSS base score across vmware vsphere's scored CVEs is 7.0.

References

All vmware vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track vmware vsphere vulnerabilities

Get an alert for each new vmware vsphere CVE, with AI-written analysis and remediation steps.

Create an account See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References

Out-of-bounds Write

4 CVEs

CWE-197Numeric Truncation Error3 CVEs

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer3 CVEs