CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
VMware ESXi, Workstation, Fusion HGFS Out-of-Bounds Read Information Disclosure (CVE-2025-22226) Technical Advisory
[Affected Scope] VMware ESXi, Workstation, and Fusion environments utilizing the Host-Guest File System (HGFS) for file sharing.
[Impact] A malicious actor with local administrative privileges on a guest VM can read out-of-bounds memory from the host's vmx process, potentially bypassing ASLR to facilitate hypervisor escape.
[Mitigation] Apply the official security patches provided by Broadcom, or disable the HGFS (Shared Folders) feature in the virtual machine configuration as a temporary workaround.
VMware ESXi VMX Process Arbitrary Write and Sandbox Escape Vulnerability (CVE-2025-22225) Security Advisory
[Affected Scope] Virtual machines and environments running on VMware ESXi hypervisors where attackers hold privileges within the VMX process
[Impact] Escape of the hypervisor sandbox and potential host takeover via arbitrary kernel write from the guest OS
[Mitigation] Immediately apply the official security patches provided by Broadcom and restrict administrative access to the VMX process
VMware ESXi and Workstation TOCTOU Out-of-Bounds Write Vulnerability (CVE-2025-22224) Analysis and Mitigation Guide
[Affected Scope] VMware ESXi and Workstation products
[Impact] A malicious actor with local administrative privileges on a guest VM can execute arbitrary code within the host's VMX process, leading to a virtual machine escape
[Mitigation] Apply the latest security patches provided by Broadcom and restrict administrative access within guest virtual machines
VMware ESXi Authentication Bypass and Privilege Escalation via Active Directory Integration (CVE-2024-37085)
[Affected Scope] VMware ESXi hosts configured to use Active Directory (AD) for user management.
[Impact] A malicious actor with group creation permissions in AD can gain full administrative access to the ESXi host by re-creating the deleted 'ESXi Admins' group.
[Mitigation] Apply the official security patches from Broadcom or change the default ESXi Admins group setting to an unprivileged/non-existent group name.
VMware Tools Host-to-Guest Authentication Bypass Vulnerability (CVE-2023-20867) Technical Analysis and Hardening Guide
[Affected Scope] Guest virtual machines running on VMware ESXi hosts with vulnerable versions of VMware Tools or open-vm-tools installed
[Impact] A fully compromised ESXi host can bypass host-to-guest authentication, compromising the confidentiality and integrity of the guest operating system
[Mitigation] Immediately upgrade VMware Tools and open-vm-tools to the latest patched versions provided by VMware and OS vendors
Service Location Protocol (SLP) Protocol Design Flaw Reflective DDoS Amplification Vulnerability (CVE-2023-29552) Security Advisory
[Affected Scope] Any network devices, virtualization hosts (such as VMware ESXi), and storage systems exposed to the internet with the Service Location Protocol (SLP, RFC 2608) enabled
[Impact] Unauthenticated remote attackers can leverage spoofed UDP traffic to launch massive reflective Denial-of-Service (DDoS) attacks, achieving an extreme amplification factor of up to 2,200x
[Mitigation] Immediately block external access to SLP ports (UDP/TCP 427) or completely disable the SLP daemon in environments where it is not required