{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T18:38:01.102Z", "tag": { "id": "vmware", "label": "VMware", "isStack": false, "url": "https://pwn.watch/t/vmware", "feed": "https://pwn.watch/t/vmware/feed.xml" }, "counts": { "incidents": 13, "live": 0, "notFullyPatched": 0, "patched": 13 }, "incidents": [ { "slug": "broadcom-vmware-vcenter-cve-2026-59310", "title": "Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability", "url": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310", "json": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Broadcom VMware vCenter", "tags": [ "vmware", "vcenter", "broadcom", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-59310" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-18", "closedAt": "2026-08-18", "updatedAt": "2026-08-18", "summary": "Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.", "xPost": null }, { "slug": "broadcom-vmware-aria-operations-cve-2026-22719", "title": "Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability", "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719", "json": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Broadcom VMware Aria Operations", "tags": [ "vmware", "broadcom", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-22719" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-03", "closedAt": "2026-03-03", "updatedAt": "2026-03-03", "summary": "Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. Added to CISA KEV on 2026-03-03.", "xPost": null }, { "slug": "broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244", "title": "Broadcom VMware Aria Operations and VMware Tools: VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability", "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244", "json": "https://pwn.watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Broadcom VMware Aria Operations and VMware Tools", "tags": [ "vmware", "broadcom", "cisa-kev" ], "cveIds": [ "CVE-2025-41244" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-30", "closedAt": "2025-10-30", "updatedAt": "2025-10-30", "summary": "Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Added to CISA KEV on 2025-10-30.", "xPost": null }, { "slug": "marks-and-spencer-ransomware-scattered-spider-april-2025", "title": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025", "json": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025.json", "status": "closed", "severity": "critical", "patchStatus": "no-fix-needed", "product": "Marks & Spencer (retail IT, VMware ESXi)", "tags": [ "marks-and-spencer", "scattered-spider", "dragonforce", "vmware", "ransomware" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-04-22", "closedAt": "2025-06-10", "updatedAt": "2025-06-10", "summary": "Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.", "xPost": null }, { "slug": "vmware-esxi-and-workstation-cve-2025-22224", "title": "VMware ESXi and Workstation: ESXi and Workstation TOCTOU Race Condition Vulnerability", "url": "https://pwn.watch/i/vmware-esxi-and-workstation-cve-2025-22224", "json": "https://pwn.watch/i/vmware-esxi-and-workstation-cve-2025-22224.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware ESXi and Workstation", "tags": [ "vmware", "cisa-kev" ], "cveIds": [ "CVE-2025-22224" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-04", "closedAt": "2025-03-04", "updatedAt": "2025-03-04", "summary": "VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. Added to CISA KEV on 2025-03-04.", "xPost": null }, { "slug": "vmware-esxi-cve-2025-22225", "title": "VMware ESXi: ESXi Arbitrary Write Vulnerability", "url": "https://pwn.watch/i/vmware-esxi-cve-2025-22225", "json": "https://pwn.watch/i/vmware-esxi-cve-2025-22225.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware ESXi", "tags": [ "vmware", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-22225" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-04", "closedAt": "2025-03-04", "updatedAt": "2025-03-04", "summary": "VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. Added to CISA KEV on 2025-03-04.", "xPost": null }, { "slug": "vmware-esxi-workstation-and-fusion-cve-2025-22226", "title": "VMware ESXi, Workstation, and Fusion: ESXi, Workstation, and Fusion Information Disclosure Vulnerability", "url": "https://pwn.watch/i/vmware-esxi-workstation-and-fusion-cve-2025-22226", "json": "https://pwn.watch/i/vmware-esxi-workstation-and-fusion-cve-2025-22226.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "VMware ESXi, Workstation, and Fusion", "tags": [ "vmware", "cisa-kev" ], "cveIds": [ "CVE-2025-22226" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-04", "closedAt": "2025-03-04", "updatedAt": "2025-03-04", "summary": "VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process. Added to CISA KEV on 2025-03-04.", "xPost": null }, { "slug": "vmware-vcenter-server-cve-2024-38812-38813", "title": "VMware vCenter Server: 2 actively exploited vulnerabilities", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2024-38812-38813", "json": "https://pwn.watch/i/vmware-vcenter-server-cve-2024-38812-38813.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware vCenter Server", "tags": [ "vmware", "vcenter", "cisa-kev" ], "cveIds": [ "CVE-2024-38812", "CVE-2024-38813" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-17", "closedAt": "2024-11-20", "updatedAt": "2024-11-20", "summary": "CVE-2024-38812: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. CVE-2024-38813: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. Added to the CISA KEV catalog on 2024-11-20.", "xPost": null }, { "slug": "vmware-vcenter-server-cve-2022-22948", "title": "VMware vCenter Server Incorrect Default File Permissions", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2022-22948", "json": "https://pwn.watch/i/vmware-vcenter-server-cve-2022-22948.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "VMware vCenter Server", "tags": [ "vmware", "vcenter", "cisa-kev" ], "cveIds": [ "CVE-2022-22948" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-17", "closedAt": "2024-07-17", "updatedAt": "2024-07-17", "summary": "VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. Added to the CISA KEV catalog on 2024-07-17. CVE-2022-22948 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "vmware-esxi-cve-2024-37085", "title": "VMware ESXi Authentication Bypass", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085", "json": "https://pwn.watch/i/vmware-esxi-cve-2024-37085.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "VMware ESXi", "tags": [ "vmware", "esxi", "auth-bypass", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-37085" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-25", "closedAt": "2024-07-30", "updatedAt": "2024-07-30", "summary": "VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "vmware-vcenter-server-cve-2023-34048", "title": "VMware vCenter Server Out-of-Bounds Write", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048", "json": "https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware vCenter Server", "tags": [ "vmware", "vcenter", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-34048" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-22", "closedAt": "2024-01-22", "updatedAt": "2024-01-22", "summary": "VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-01-22. CVE-2023-34048 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "vmware-tools-cve-2023-20867", "title": "VMware Tools: Authentication Bypass (CVE-2023-20867)", "url": "https://pwn.watch/i/vmware-tools-cve-2023-20867", "json": "https://pwn.watch/i/vmware-tools-cve-2023-20867.json", "status": "closed", "severity": "low", "patchStatus": "patched", "product": "VMware Tools", "tags": [ "vmware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2023-20867" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-06-23", "closedAt": "2023-06-23", "updatedAt": "2023-06-23", "summary": "VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. Added to CISA KEV on 2023-06-23.", "xPost": null }, { "slug": "vmware-aria-operations-for-networks-cve-2023-20887", "title": "VMware Aria Operations for Networks: Command Injection (CVE-2023-20887)", "url": "https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887", "json": "https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "VMware Aria Operations for Networks", "tags": [ "vmware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-20887" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-06-22", "closedAt": "2023-06-22", "updatedAt": "2023-06-22", "summary": "VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution. Added to CISA KEV on 2023-06-22.", "xPost": null } ], "posts": [], "changes": [ { "incident": "broadcom-vmware-vcenter-cve-2026-59310", "incidentTitle": "Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310" }, { "incident": "broadcom-vmware-aria-operations-cve-2026-22719", "incidentTitle": "Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-03", "title": "CISA added CVE-2026-22719 to the KEV catalog (due 2026-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719" }, { "incident": "broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244", "incidentTitle": "Broadcom VMware Aria Operations and VMware Tools: VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-30", "title": "CISA added CVE-2025-41244 to the KEV catalog (due 2025-11-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-06-10", "title": "Online clothing orders resume after 46 days", "body": null, "sourceUrl": "https://www.reuters.com/business/retail-consumer/uks-ms-resumes-online-orders-following-cyber-incident-2025-06-10/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-05-21", "title": "M&S estimates about £300M cost; disruption to last into July", "body": null, "sourceUrl": "https://www.reuters.com/business/media-telecom/britains-ms-says-cyberattack-cost-400-million-2025-05-21/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-04-29", "title": "Attack linked to Scattered Spider and DragonForce ransomware on ESXi", "body": null, "sourceUrl": "https://www.bleepingcomputer.com/news/security/marks-and-spencer-breach-linked-to-scattered-spider-ransomware-attack/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "marks-and-spencer-ransomware-scattered-spider-april-2025", "incidentTitle": "Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days", "severity": "critical", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-04-25", "title": "M&S pauses online orders after a cyber incident", "body": null, "sourceUrl": "https://www.reuters.com/business/retail-consumer/britains-ms-pauses-some-online-orders-after-cyber-incident-2025-04-25/", "url": "https://pwn.watch/i/marks-and-spencer-ransomware-scattered-spider-april-2025" }, { "incident": "vmware-esxi-and-workstation-cve-2025-22224", "incidentTitle": "VMware ESXi and Workstation: ESXi and Workstation TOCTOU Race Condition Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-04", "title": "CISA added CVE-2025-22224 to the KEV catalog (due 2025-03-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-esxi-and-workstation-cve-2025-22224" }, { "incident": "vmware-esxi-cve-2025-22225", "incidentTitle": "VMware ESXi: ESXi Arbitrary Write Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-04", "title": "CISA added CVE-2025-22225 to the KEV catalog (due 2025-03-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-esxi-cve-2025-22225" }, { "incident": "vmware-esxi-workstation-and-fusion-cve-2025-22226", "incidentTitle": "VMware ESXi, Workstation, and Fusion: ESXi, Workstation, and Fusion Information Disclosure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-03-04", "title": "CISA added CVE-2025-22226 to the KEV catalog (due 2025-03-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-esxi-workstation-and-fusion-cve-2025-22226" }, { "incident": "vmware-vcenter-server-cve-2024-38812-38813", "incidentTitle": "VMware vCenter Server: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-20", "title": "CISA added CVE-2024-38812 to the KEV catalog (federal deadline 2024-12-11)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2024-38812-38813" }, { "incident": "vmware-vcenter-server-cve-2024-38812-38813", "incidentTitle": "VMware vCenter Server: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-11-20", "title": "CISA added CVE-2024-38813 to the KEV catalog (federal deadline 2024-12-11)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2024-38812-38813" }, { "incident": "vmware-vcenter-server-cve-2024-38812-38813", "incidentTitle": "VMware vCenter Server: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-17", "title": "CVE-2024-38812 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38812", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2024-38812-38813" }, { "incident": "vmware-vcenter-server-cve-2024-38812-38813", "incidentTitle": "VMware vCenter Server: 2 actively exploited vulnerabilities", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-17", "title": "CVE-2024-38813 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38813", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2024-38812-38813" }, { "incident": "vmware-esxi-cve-2024-37085", "incidentTitle": "VMware ESXi Authentication Bypass", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-07-30", "title": "CISA added CVE-2024-37085 to the KEV catalog (federal deadline 2024-08-20)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085" }, { "incident": "vmware-vcenter-server-cve-2022-22948", "incidentTitle": "VMware vCenter Server Incorrect Default File Permissions", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-07-17", "title": "CISA added CVE-2022-22948 to the KEV catalog (federal deadline 2024-08-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2022-22948" }, { "incident": "vmware-esxi-cve-2024-37085", "incidentTitle": "VMware ESXi Authentication Bypass", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2024-06-25", "title": "CVE-2024-37085 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-37085", "url": "https://pwn.watch/i/vmware-esxi-cve-2024-37085" }, { "incident": "vmware-vcenter-server-cve-2023-34048", "incidentTitle": "VMware vCenter Server Out-of-Bounds Write", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-22", "title": "CISA added CVE-2023-34048 to the KEV catalog (federal deadline 2024-02-12)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/vmware-vcenter-server-cve-2023-34048" }, { "incident": "vmware-tools-cve-2023-20867", "incidentTitle": "VMware Tools: Authentication Bypass (CVE-2023-20867)", "severity": "low", "status": "closed", "patchStatus": "patched", "date": "2023-06-23", "title": "CISA added CVE-2023-20867 to the KEV catalog (due 2023-07-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-tools-cve-2023-20867" }, { "incident": "vmware-aria-operations-for-networks-cve-2023-20887", "incidentTitle": "VMware Aria Operations for Networks: Command Injection (CVE-2023-20887)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-22", "title": "CISA added CVE-2023-20887 to the KEV catalog (due 2023-07-13).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/vmware-aria-operations-for-networks-cve-2023-20887" } ] }