VMware exploitation status and PlainSec coverage
9 CVEs on this page carry evidence of exploitation.
Which VMware vulnerabilities are being exploited?
9 of them are in the CISA KEV catalog.
- CVE-2026-22719 In KEV since 2026-03-03 · EPSS 18% · Fix identified
- CVE-2025-22224 In KEV since 2025-03-04 · EPSS 2% · Fix identified
- CVE-2023-34048 In KEV since 2024-01-22 · EPSS 99% · Fix identified
- CVE-2022-22947 In KEV since 2022-05-16 · EPSS 98% · Fix not stated in our records
- CVE-2022-22965 In KEV since 2022-04-04 · EPSS 99.6% · Fix identified
- CVE-2021-21973 In KEV since 2022-03-07 · EPSS 88% · Fix not stated in our records
- CVE-2021-21985 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · Fix not stated in our records
- CVE-2021-22005 In KEV since 2021-11-03 · EPSS 100.0% · Used in ransomware · Fix not stated in our records
- CVE-2021-21972 In KEV since 2021-11-03 · EPSS 99.9% · Used in ransomware · Fix not stated in our records
Which of them have a fix?
We can name a fix for 4 of them.
For the rest we hold no patch identifier, which is not the same as no patch existing.
What PlainSec published about VMware
Which VMware products this page tracks
- VMware
- VMware ESXi
- VMware Horizon
- VMware NSX
- VMware Workstation
- VMware vCenter
- VMware vCenter Server and Cloud Foundation
- vCenter Server
KEV and EPSS are re-checked daily. Page last updated 2026-10-29.