Advisories · Technology

VMware Cloud Foundation.

Every CVE that names VMware Cloud Foundation among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-41709 CVE record

CVSS 2.7 LowCritical · KEVKEV

ESX insufficient logging vulnerability
- VMware Cloud Foundation
- VMware vSphere Foundation
- CWE-778
Not analysed yet 30 Jul 2026
CVE-2026-41703 CVE record

CVSS 7.6 High

Out-of-bounds read vulnerability
- VMware Cloud Foundation
- VMware vSphere Foundation
- Memory corruption
Not analysed yet 30 Jul 2026
CVE-2026-47876 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

VMXNET3 out-of-bounds write vulnerability
- VMware Cloud Foundation
- VMware vSphere Foundation
- Memory corruption
Not analysed yet 30 Jul 2026
CVE-2026-59309 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

vCenter authentication-bypass vulnerability
- VMware Cloud Foundation
- VMware vSphere Foundation
- Authentication bypass
Not analysed yet 30 Jul 2026
CVE-2026-59310 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+KEV · ransomware

vCenter directory-traversal vulnerability
- VMware Cloud Foundation
- VMware vSphere Foundation
- Path traversal
Not analysed yet 30 Jul 2026
CVE-2026-22721 CVE record

CVSS 6.2 Medium

VMware Aria Operations privilege escalation vulnerability
- VMware Aria Operations
- VMware Cloud Foundation
- Privilege escalation
Not analysed yet 25 Feb 2026
CVE-2025-41250 CVE record

CVSS 8.5 High

Header injection vulnerability
- VMware vCenter
- VMware Cloud Foundation
- Command injection
Not analysed yet 29 Sept 2025
CVE-2025-41245 CVE record

CVSS 4.9 Medium

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
- VMware Aria Operations
- VMware Cloud Foundation
- CWE-1188
Not analysed yet 29 Sept 2025
CVE-2025-41244 CVE record

CVSS 7.8 HighCritical · KEVKEV

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
- VMware VCF operations
- VMware tools
- Privilege escalation
Not analysed yet 29 Sept 2025
CVE-2025-41241 CVE record

CVSS 4.4 Medium

Denial-of-service vulnerability
- VMware vCenter
- VMware Cloud Foundation
- CWE-754
Not analysed yet 29 Jul 2025
CVE-2025-41239 CVE record

CVSS 7.1 High

vSockets information-disclosure vulnerability
- VMware ESXi
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 15 Jul 2025
CVE-2025-41238 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

PVSCSI heap-overflow vulnerability
- VMware ESXi
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 15 Jul 2025
CVE-2025-41237 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

VMCI integer-underflow vulnerability
- VMware Cloud Foundation
- VMware vSphere Foundation
- Memory corruption
Not analysed yet 15 Jul 2025
CVE-2025-41236 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

VMXNET3 integer-overflow vulnerability
- VMware ESXi
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 15 Jul 2025
CVE-2025-41228 CVE record

CVSS 4.3 Medium

VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Cross-site scripting (XSS)
Not analysed yet 20 May 2025
CVE-2025-41227 CVE record

CVSS 5.5 Medium

Denial-of-Service Vulnerability
- VMware ESXi
- VMware Cloud Foundation
- Denial of service
Not analysed yet 20 May 2025
CVE-2025-41226 CVE record

CVSS 6.8 Medium

Guest Operations Denial-of-Service Vulnerability
- VMware ESXi
- VMware Cloud Foundation
- Denial of service
Not analysed yet 20 May 2025
CVE-2025-41225 CVE record

CVSS 8.8 High

VMware vCenter Server authenticated command-execution vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Command injection
Not analysed yet 20 May 2025
CVE-2025-41231 CVE record

CVSS 7.3 High

VMware Cloud Foundation Missing Authorisation Vulnerability
- VMware Cloud Foundation
- Broken access control
Not analysed yet 20 May 2025
CVE-2025-41230 CVE record

CVSS 7.5 High

VMware Cloud Foundation Information Disclosure Vulnerability
- VMware Cloud Foundation
- Information disclosure
Not analysed yet 20 May 2025
CVE-2025-41229 CVE record

CVSS 8.2 High

VMware Cloud Foundation Directory Traversal Vulnerability
- VMware Cloud Foundation
- Path traversal
Not analysed yet 20 May 2025
CVE-2025-22249 CVE record

CVSS 8.2 High

VMSA-2025-0008: VMware Aria automation updates address a DOM based Cross-site scripting vulnerability (CVE-2025-22249)
- Vmware Aria Automation
- VMware Cloud Foundation
- Cross-site scripting (XSS)
Not analysed yet 13 May 2025
CVE-2025-22226 CVE record

CVSS 7.1 HighCritical · KEVKEV

Out-of-bounds read in ESXi and others
- ESXi
- VMware Workstation
- Memory corruption
Not analysed yet 4 Mar 2025
CVE-2025-22225 CVE record

CVSS 8.2 HighCritical · KEVKEV · ransomware

VMware ESXi contains an arbitrary write vulnerability.
- VMware ESXi
- VMware Cloud Foundation
- CWE-123
Not analysed yet 4 Mar 2025
CVE-2025-22224 CVE record

CVSS 9.3 CriticalCritical · KEV, CVSS 9+KEV

Time-of-check time-of-use race condition in VMware ESXi and others
- VMware ESXi
- VMware Workstation
- Race condition
Not analysed yet 4 Mar 2025
CVE-2024-38813 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

Privilege escalation vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Privilege escalation
- CWE-273
Not analysed yet 17 Sept 2024
CVE-2024-38812 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Heap-overflow vulnerability
- VMware vCenter Server
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 17 Sept 2024
CVE-2024-37087 CVE record

CVSS 5.3 Medium

Incorrect permission assignment in vCenter Server and others
- vCenter Server
- VMware Cloud Foundation
- Broken access control
Not analysed yet 25 Jun 2024
CVE-2024-37086 CVE record

CVSS 6.8 Medium

Out-of-bounds read in ESXi and others
- ESXi
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 25 Jun 2024
CVE-2024-37085 CVE record

CVSS 6.8 MediumCritical · KEVKEV · ransomware

VMware ESXi contains an authentication bypass vulnerability.
- VMware ESXi
- VMware Cloud Foundation
- CWE-305
Not analysed yet 25 Jun 2024
CVE-2024-37081 CVE record

CVSS 7.8 High

The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.
- VMware vCenter Server
- VMware Cloud Foundation
- CWE-556
Not analysed yet 18 Jun 2024
CVE-2024-37080 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Heap-based buffer overflow in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 18 Jun 2024
CVE-2024-37079 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Out-of-bounds write in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 18 Jun 2024
CVE-2024-22255 CVE record

CVSS 7.1 High

Information disclosure vulnerability
- VMware ESXi
- VMware Workstation
- Denial of service
Not analysed yet 5 Mar 2024
CVE-2024-22254 CVE record

CVSS 7.9 High

Out-of-bounds write vulnerability
- VMware ESXi
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 5 Mar 2024
CVE-2024-22253 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Use-after-free vulnerability
- VMware ESXi
- VMware Workstation
- Memory corruption
Not analysed yet 5 Mar 2024
CVE-2024-22252 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Use-after-free vulnerability
- VMware ESXi
- VMware Workstation
- Memory corruption
Not analysed yet 5 Mar 2024
CVE-2022-22939 CVE record

VMware Cloud Foundation: VMware Cloud Foundation contains an information disclosure vulnerability due to logging…
- VMware Cloud Foundation
Not analysed yet 4 Feb 2022
CVE-2021-21974 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Out-of-bounds write in VMware ESXi and others
- VMware ESXi
- VMware Cloud Foundation
- Memory corruption
Not analysed yet 24 Feb 2021
CVE-2021-21972 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Path traversal in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Path traversal
Not analysed yet 24 Feb 2021
CVE-2021-21973 CVE record

CVSS 5.3 MediumCritical · KEVKEV

Server-side request forgery in VMware vCenter Server and others
- VMware vCenter Server
- VMware Cloud Foundation
- Server-side request forgery (SSRF)
Not analysed yet 24 Feb 2021