FAIL › dossier
VMware, Inc.
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 20%
VMware is a major virtualization vendor with a severe security history dominated by critical RCE vulnerabilities in its core products like ESXi and vCenter. Many of these flaws are actively exploited by ransomware and other threat actors, and the company struggles with patching and default configurations that expose its infrastructure to network-accessible attacks.
PROFILE
CategoryvirtualizationWhat they doVMware provides enterprise virtualization, cloud management, and networking software including ESXi, vCenter, and Workspace ONE.
Websitehttps://www.vmware.com ↗
SECURITY POSTURE
VMware has a poor security track record characterized by a high frequency of critical remote code execution (RCE) vulnerabilities across its core virtualization stack, including ESXi and vCenter, many of which are actively exploited on the CISA KEV list.
Notable failures
- CVE-2025-22225: Critical arbitrary write in ESXi enabling sandbox escapes and active ransomware exploitation
- CVE-2022-22954: Critical RCE in Workspace ONE Access via server-side template injection
- CVE-2021-21985: Critical RCE in vSphere Client via improper input validation in Virtual SAN Health Check
Patterns: repeated critical RCEs in core virtualization components (ESXi, vCenter); active exploitation of vulnerabilities on the CISA KEV list; vulnerabilities in default or enabled services (e.g., Virtual SAN Health Check, OpenSLP)
FAILURE HISTORY · 40
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2021-11-03 | CVE-2021-21985 | critical | VMware vCenter Server RCE due to unpatched input validation flaw |
| 2026-08-27 | CVE-2026-59270 | critical | VMware vCenter's embedded UnboundID LDAP server unconditionally registers an admin credential and binds to all network interfaces, enabling remote access. |
| 2025-03-04 | CVE-2025-22225 | critical | A critical arbitrary write vulnerability in VMware ESXi allows sandbox escapes and is actively exploited by ransomware. |
| 2024-11-20 | CVE-2024-38813 | high | VMware vCenter Server allows remote privilege escalation to root via a dropped privileges check bypass, enabling attackers to gain full control of the system. |
| 2024-01-22 | CVE-2023-34048 | high | VMware vCenter Server was exploited in the wild via CVE-2023-34048, enabling remote code execution through an out-of-bounds write in the DCERPC protocol. |
| 2021-11-03 | CVE-2020-3952 | high | An unpatched directory traversal flaw in VMware vCenter's Syslog server allowed unauthenticated attackers to gain persistent remote access via reverse SSH backdoors. |
| 2021-11-03 | CVE-2021-22005 | critical | VMware's vCenter Server had a file upload vulnerability actively exploited by ransomware actors, allowing code execution over port 443. |
| 2024-07-30 | CVE-2024-37085 | critical | VMware ESXi allows attackers with AD permissions to regain full host access by recreating a deleted admin group. |
| 2022-04-04 | CVE-2022-22965 | high | VMware Spring Framework apps on JDK 9+ suffered remote code execution via data binding. |
| 2022-03-25 | CVE-2018-6961 | high | VMware SD-WAN Edge suffered a command injection flaw in its local web UI allowing remote code execution. |
| 2022-03-07 | CVE-2021-21973 | high | Attackers exploited an unpatched SSRF vulnerability in VMware vCenter Server to gain persistent remote access and deploy backdoors. |
| 2022-01-10 | CVE-2021-22017 | high | Attackers exploited a directory-traversal flaw in VMware vCenter's Syslog server to gain persistent remote access. |
| 2021-11-03 | CVE-2020-3950 | high | Improper use of setuid binaries in VMware Fusion, VMRC, and Horizon Client for Mac allowed privilege escalation to root. |
| 2021-11-03 | CVE-2020-4006 | high | Command injection flaw in VMware Workspace One products allowed attackers with admin access to execute unrestricted OS commands. |
| 2022-05-16 | CVE-2022-22947 | high | VMware Spring Cloud Gateway allows code injection via its exposed and unsecured Actuator endpoint when enabled. |
| 2025-03-04 | CVE-2025-22226 | high | VMware virtualization products have an information disclosure vulnerability actively exploited in the wild, potentially allowing memory leakage from privileged virtual machines. |
| 2023-06-23 | CVE-2023-20867 | high | VMware Tools Authentication Bypass Vulnerability |
| 2023-06-22 | CVE-2023-20887 | high | VMware Aria Operations for Networks command injection vulnerability allows remote code execution. |
| 2022-04-14 | CVE-2022-22954 | critical | VMware Workspace ONE Access suffered a server-side template injection vulnerability enabling remote code execution and actively exploited by ransomware actors. |
| 2022-01-18 | CVE-2021-21975 | critical | VMware's vRealize Operations Manager API had a critical SSRF vulnerability exploited in the wild, potentially leading to credential theft and system compromise. |
| 2021-11-03 | CVE-2019-5544 | critical | VMware ESXi and Horizon DaaS products contained a heap-based buffer overflow vulnerability actively exploited by attackers to achieve remote code execution (RCE). |
| 2021-11-03 | CVE-2021-21972 | critical | VMware vCenter Server RCE due to unpatched plugin exploited in wild |
| 2021-11-03 | CVE-2020-3992 | critical | VMware ESXi's OpenSLP service had a remotely exploitable use-after-free vulnerability linked to ransomware activity, requiring immediate patching and network segmentation review. |
| 2022-04-15 | CVE-2022-22960 | high | VMware Workspace ONE Access, Identity Manager, and vRealize Automation suffered a privilege escalation vulnerability due to improper permissions in support scripts. |
| 2025-03-04 | CVE-2025-22224 | high | VMware ESXi and Workstation vulnerabilities allow code execution with local admin privileges, and are currently being exploited in the wild. |
| 2024-11-20 | CVE-2024-38812 | high | VMware vCenter Server exploited via heap-based buffer overflow enabling remote code execution. |
| 2024-07-17 | CVE-2022-22948 | high | VMware vCenter Server shipped with incorrect default file permissions enabling remote privileged attackers to access sensitive data. |
| 2026-08-27 | CVE-2026-47864 | medium | CVE-2026-47864: SerializingHttpMessageConverter deserializes the body of incoming HTTP requests |
| 2026-08-26 | CVE-2026-47837 | medium | CVE-2026-47837: Missing Authentication for Critical Function vulnerability in Spring Spring Clou |
| 2026-08-21 | CVE-2026-59318 | medium | CVE-2026-59318: In Spring AI's tool calling support, the per-request tool list is advertised to |
| 2026-06-11 | CVE-2026-41699 | high | CVE-2026-41699: Spring for GraphQL applications are vulnerable to Unsafe Deserialization when pr |
| 2026-06-09 | CVE-2026-41855 | high | CVE-2026-41855: In an untrusted JMS environment, org.springframework.jms.support.converter.Mappi |
| 2026-04-28 | CVE-2026-40974 | medium | CVE-2026-40974: Spring Boot's Cassandra auto-configuration does not perform hostname verificatio |
| 2026-04-27 | CVE-2026-40971 | medium | CVE-2026-40971: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration |
| 2021-05-26 | CVE-2021-21985 | critical | CVE-2021-21985: The vSphere Client (HTML5) contains a remote code execution vulnerability due to |
| 2021-02-24 | CVE-2021-21972 | critical | CVE-2021-21972: The vSphere Client (HTML5) contains a remote code execution vulnerability in a v |
| 2020-10-20 | CVE-2020-3992 | critical | CVE-2020-3992: OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before E |
| 2020-01-02 | CVE-2016-1000027 | critical | CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code exe |
| 2018-04-11 | CVE-2018-1273 | critical | CVE-2018-1273: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older |
| 2018-04-06 | CVE-2018-1270 | critical | CVE-2018-1270: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
VMware's SSRF vulnerability in vCenter Server and Cloud Foundation Server was a significant security failure, allowing information disclosure through improper URL validation in a plugin. The NVD entry
synthesissevere-fallout-0.60
VMware faced severe fallout from CVE-2021-21975, a critical SSRF vulnerability in vRealize Operations Manager that allowed attackers to steal administrative credentials. The NVD entry highlights the s
synthesissevere-fallout-0.60
Vulnerability in core vCenter component exposed to remote code execution, widely acknowledged as a critical flaw requiring immediate patching.
synthesissevere-fallout-0.60
VMware's critical RCE flaw in vCenter Server was widely condemned by security press and authorities, with CISA adding it to the KEV catalog and mandating emergency patches, reflecting severe fallout a
synthesissevere-fallout-0.60
VMware's OpenSLP vulnerability (CVE-2020-3992) is a severe use-after-free flaw allowing remote code execution on the management network, but the provided sources lack direct commentary on VMware's res
synthesissevere-fallout-0.60
Command injection in core identity management products allows unrestricted OS command execution, representing a critical security failure with severe fallout for VMware's security posture.
synthesissevere-fallout-0.60
VMware's default-enabled vulnerability in a core management component allowed remote code execution, representing a severe oversight in input validation and security posture.
synthesisneutral+0.00
No sentiment expressed; sources are technical databases or unrelated articles.
synthesissevere-fallout-0.60
NIST and CISA treat CVE-2020-3952 as a high-severity, known exploited vulnerability, indicating severe fallout for VMware's security posture despite no direct press condemnation in the provided source
synthesissevere-fallout-0.60
VMware faced severe fallout due to actively exploited zero-day vulnerabilities in ESXi, leading to ransomware attacks and urgent patch releases under Broadcom ownership.
synthesissevere-fallout-0.60
VMware's setuid vulnerability in Fusion/VMRC/Horizon Client for Mac was a critical privilege escalation flaw allowing root access, widely flagged as severe by NVD and security press, reflecting poorly
synthesissevere-fallout-0.60
VMware faced severe fallout due to a critical RCE vulnerability in vSphere Client, widely exploited by attackers, with industry press highlighting active weaponization and urgent patching demands.
synthesissevere-fallout-0.60
VMware faced severe fallout for a critical RCE vulnerability in vCenter Server, allowing unrestricted OS command execution via a plugin. The flaw affected multiple versions and was publicly disclosed,
synthesissevere-fallout-0.60
VMware faced severe fallout as active exploitation of its vCenter vulnerabilities was widely reported, indicating a critical failure in security posture and response.
synthesissevere-fallout-0.60
Vendor dismissed vulnerability as non-intended use case, refusing behavior change despite RCE risk.
VMware's SSRF vulnerability in vCenter Server and Cloud Foundation Server was a significant security failure, allowing information disclosure through improper URL validation in a plugin. The NVD entry
"VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure."
VMware faced severe fallout from CVE-2021-21975, a critical SSRF vulnerability in vRealize Operations Manager that allowed attackers to steal administrative credentials. The NVD entry highlights the s
"Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials."
Critical flaw in core vCenter component, widely acknowledged as requiring immediate patching.
"Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization."
CVE Find provides neutral database context without specific sentiment toward VMware.
Critical setuid privilege escalation flaw in VMware Mac products allowing root access, widely condemned as a severe security oversight.
"VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root."
NIST's official site provides neutral institutional context without specific sentiment toward VMware.
NVD page provides no direct sentiment toward VMware, only listing the vulnerability database.
NVD entry confirms the severe technical nature of the flaw but offers no vendor response or handling assessment.
"VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution."
Sploitus highlights the exploit's ability to taint the Administrators group, indicating severe fallout for VMware's access control failures.
"LDAP injection in VMware vCenter allows tainting the Administrators group via description attribute."
Tech Insider highlights a different VMware flaw (CVE-2026-59310) with severe fallout, but this is unrelated to CVE-2020-3992 and thus irrelevant to the specific event.
"A single flaw in VMware vCenter has turned into one of the more consequential enterprise-security stories of August 2026."
The Hacker News discusses a different vendor (Oracle) and flaw, making it entirely irrelevant to the VMware CVE-2020-3992 event.
"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog."
UpGuard provides vendor risk reporting services but contains no commentary on VMware's handling of CVE-2020-3992.
GitHub mirrors CISA KEV data but contains no commentary on VMware's handling of CVE-2020-3992.
CVE Find provides vulnerability intelligence but contains no commentary on VMware's handling of CVE-2020-3992.
XposedOrNot provides neutral breach directory context without specific sentiment toward VMware.
FEDRAMP CATALOG PRODUCTS · 2
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| VMware Government Services (VGS) | Authorized | High |
| Workspace ONE | Authorized | Moderate |
DOSSIER SOURCES
- VMware ESXi: Releases, patches & end-of-life - versio.io · www.versio.io
- How to patch VMware ESXi — update to the latest secure version ... · www.isitpatched.com
- VMware vCenter Server: Releases, patches & end-of-life · www.versio.io
Open questions: VMware's current patch SLA and emergency response procedures · VMware's security architecture review and third-party audit results
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-16 04:39:39.264522+00:00