Is itCheck something

Attack list

VMware

21 attacked bugs

Yes. Attackers are using VMware bugs right now.

What to do

Ask whoever runs it (your web host or IT team) to install the vendor's latest security update now.

Attackers keep using these against anything that hasn't updated. Updating closes them.

BugConfirmed in attacks

  1. A VMware ESX admin can act without leaving a log entryCVE-2026-41709Oct 28, 2026
  2. Broadcom VMware vCenter bug: vcenter path traversalCVE-2026-59310Aug 18, 2026
  3. Broadcom VMware Aria Operations bug: operations command injectionCVE-2026-22719Mar 3, 2026
  4. Broadcom VMware vCenter Server bug: vcenter server out-of-bounds writeCVE-2024-37079Jan 23, 2026
  5. Broadcom VMware Aria Operations and VMware Tools bug: operations and vmware tools privilege defined with unsafe actionsCVE-2025-41244Oct 30, 2025
  6. VMware ESXi, Workstation, and Fusion bug: esxi, workstation, and fusion information disclosureCVE-2025-22226Mar 4, 2025
  7. VMware ESXi bug: arbitrary writeCVE-2025-22225Mar 4, 2025
  8. VMware ESXi and Workstation bug: workstation TOCTOU race conditionCVE-2025-22224Mar 4, 2025
  9. VMware vCenter Server bug: privilege escalationCVE-2024-38813Nov 20, 2024
  10. VMware vCenter Server bug: heap-based buffer overflowCVE-2024-38812Nov 20, 2024
  11. VMware ESXi bug: authentication bypassCVE-2024-37085Jul 30, 2024
  12. VMware vCenter Server bug: incorrect default file permissions vulnerabilityCVE-2022-22948Jul 17, 2024
  13. VMware vCenter Server bug: out-of-bounds writeCVE-2023-34048Jan 22, 2024
  14. VMware vCenter Server and Cloud Foundation bug: cloud foundation server side request forgery (SSRF)CVE-2021-21973Mar 7, 2022
  15. VMware vCenter Server bug: improper access controlCVE-2021-22017Jan 10, 2022
  16. VMware ESXi and Horizon DaaS bug: horizon daas openslp heap-based buffer overflowCVE-2019-5544Nov 3, 2021
  17. VMware ESXi bug: openslp use-after-freeCVE-2020-3992Nov 3, 2021
  18. VMware vCenter Server bug: file uploadCVE-2021-22005Nov 3, 2021
  19. VMware vCenter Server bug: information disclosureCVE-2020-3952Nov 3, 2021
  20. VMware vCenter Server bug: remote code executionCVE-2021-21972Nov 3, 2021
  21. VMware vCenter Server bug: improper input validationCVE-2021-21985Nov 3, 2021

From the US government's list of bugs confirmed in real attacks (CISA KEV). Check everything you use.