CISA KEV by vendor
VMware vulnerabilities in the CISA KEV catalogue
26 VMware entries in CISA's Known Exploited Vulnerabilities catalogue, 9 of them (35 percent) known to have been used in ransomware campaigns. First added 3 November 2021, latest 4 March 2025.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
26entries, 1.5% of the catalogue
9known ransomware use
0added in the last 7 days
0federal due dates in the next 14 days
Products
| Product, as CISA names it | Entries |
|---|---|
| vCenter Server | 9 |
| ESXi | 3 |
| Multiple Products | 3 |
| ESXi, Workstation, and Fusion | 1 |
| ESXi and Workstation | 1 |
| Tools | 1 |
| Aria Operations for Networks | 1 |
| Spring Cloud Gateway | 1 |
| Workspace ONE Access and Identity Manager | 1 |
| Spring Framework | 1 |
| SD-WAN Edge | 1 |
| vCenter Server and Cloud Foundation | 1 |
| vRealize Operations Manager API | 1 |
| VMware ESXi and Horizon DaaS | 1 |
Latest additions
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-22226 | ESXi, Workstation, and Fusion | 2025-03-04 | 2025-03-25 | Unknown | 6.0 Medium | 1.6% | Not auto, partial | 14 days |
| CVE-2025-22225 | ESXi | 2025-03-04 | 2025-03-25 | Known | 8.2 High | 1.0% | Not auto, total | 3 days + triage |
| CVE-2025-22224 | ESXi and Workstation | 2025-03-04 | 2025-03-25 | Unknown | 8.2 High | 1.5% | Not auto, total | 3 days + triage |
| CVE-2024-38813 | vCenter Server | 2024-11-20 | 2024-12-11 | Unknown | 9.8 Critical | 17.3% | Not auto, total | 3 days + triage |
| CVE-2024-38812 | vCenter Server | 2024-11-20 | 2024-12-11 | Unknown | 9.8 Critical | 54.5% | Auto, total | 3 days + triage |
| CVE-2024-37085 | ESXi | 2024-07-30 | 2024-08-20 | Known | 7.2 High | 26.7% | Not auto, total | 3 days + triage |
| CVE-2022-22948 | vCenter Server | 2024-07-17 | 2024-08-07 | Unknown | 6.5 Medium | 13.2% | Not auto, total | 3 days + triage |
| CVE-2023-34048 | vCenter Server | 2024-01-22 | 2024-02-12 | Unknown | 9.8 Critical | 99.2% | Not auto, total | 3 days + triage |
| CVE-2023-20867 | Tools | 2023-06-23 | 2023-07-14 | Unknown | 3.9 Low | 13.6% | Not auto, partial | 14 days |
| CVE-2023-20887 | Aria Operations for Networks | 2023-06-22 | 2023-07-13 | Unknown | 9.8 Critical | 98.2% | Auto, total | 3 days + triage |
All 26 entries
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-22226 | ESXi, Workstation, and Fusion | 2025-03-04 | 2025-03-25 | Unknown | 6.0 Medium | 1.6% | Not auto, partial | 14 days |
| CVE-2025-22225 | ESXi | 2025-03-04 | 2025-03-25 | Known | 8.2 High | 1.0% | Not auto, total | 3 days + triage |
| CVE-2025-22224 | ESXi and Workstation | 2025-03-04 | 2025-03-25 | Unknown | 8.2 High | 1.5% | Not auto, total | 3 days + triage |
| CVE-2024-38813 | vCenter Server | 2024-11-20 | 2024-12-11 | Unknown | 9.8 Critical | 17.3% | Not auto, total | 3 days + triage |
| CVE-2024-38812 | vCenter Server | 2024-11-20 | 2024-12-11 | Unknown | 9.8 Critical | 54.5% | Auto, total | 3 days + triage |
| CVE-2024-37085 | ESXi | 2024-07-30 | 2024-08-20 | Known | 7.2 High | 26.7% | Not auto, total | 3 days + triage |
| CVE-2022-22948 | vCenter Server | 2024-07-17 | 2024-08-07 | Unknown | 6.5 Medium | 13.2% | Not auto, total | 3 days + triage |
| CVE-2023-34048 | vCenter Server | 2024-01-22 | 2024-02-12 | Unknown | 9.8 Critical | 99.2% | Not auto, total | 3 days + triage |
| CVE-2023-20867 | Tools | 2023-06-23 | 2023-07-14 | Unknown | 3.9 Low | 13.6% | Not auto, partial | 14 days |
| CVE-2023-20887 | Aria Operations for Networks | 2023-06-22 | 2023-07-13 | Unknown | 9.8 Critical | 98.2% | Auto, total | 3 days + triage |
| CVE-2022-22947 | Spring Cloud Gateway | 2022-05-16 | 2022-06-06 | Unknown | 10.0 Critical | 98.2% | Auto, total | 3 days + triage |
| CVE-2022-22960 | Multiple Products | 2022-04-15 | 2022-05-06 | Unknown | 7.8 High | 35.5% | Not auto, total | 3 days + triage |
| CVE-2022-22954 | Workspace ONE Access and Identity Manager | 2022-04-14 | 2022-05-05 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2022-22965 | Spring Framework | 2022-04-04 | 2022-04-25 | Unknown | 9.8 Critical | 99.6% | Auto, total | 3 days + triage |
| CVE-2018-6961 | SD-WAN Edge | 2022-03-25 | 2022-04-15 | Unknown | 8.1 High | 85.3% | Not auto, total | 3 days + triage |
| CVE-2021-21973 | vCenter Server and Cloud Foundation | 2022-03-07 | 2022-03-21 | Unknown | 5.3 Medium | 88.0% | Auto, partial | 3 days |
| CVE-2021-21975 | vRealize Operations Manager API | 2022-01-18 | 2022-02-01 | Known | 7.5 High | 78.0% | Auto, total | 3 days + triage |
| CVE-2021-22017 | vCenter Server | 2022-01-10 | 2022-01-24 | Unknown | 5.3 Medium | 49.1% | Auto, partial | 3 days |
| CVE-2021-22005 | vCenter Server | 2021-11-03 | 2021-11-17 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2021-21985 | vCenter Server | 2021-11-03 | 2021-11-17 | Known | 9.8 Critical | 99.9% | Auto, total | 3 days + triage |
| CVE-2021-21972 | vCenter Server | 2021-11-03 | 2021-11-17 | Known | 9.8 Critical | 99.8% | Auto, total | 3 days + triage |
| CVE-2020-4006 | Multiple Products | 2021-11-03 | 2022-05-03 | Unknown | 9.1 Critical | 17.3% | Not auto, total | 3 days + triage |
| CVE-2020-3992 | ESXi | 2021-11-03 | 2022-05-03 | Known | 9.8 Critical | 83.0% | Auto, total | 3 days + triage |
| CVE-2020-3952 | vCenter Server | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 90.3% | Auto, total | 3 days + triage |
| CVE-2020-3950 | Multiple Products | 2021-11-03 | 2022-05-03 | Unknown | 7.8 High | 7.2% | Not auto, total | 3 days + triage |
| CVE-2019-5544 | VMware ESXi and Horizon DaaS | 2021-11-03 | 2022-05-03 | Known | 9.8 Critical | 98.1% | Auto, total | 3 days + triage |
Due dates bind US federal civilian executive branch agencies only (BOD 26-04). Filter VMware in the tracker by date, score or status.
Source: CISA Known Exploited Vulnerabilities Catalog; NVD, FIRST EPSS and CISA SSVC for the scores. This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs.