pwn.watch: VMware incident updates

[high] Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability

Tue, 18 Aug 2026 00:00:00 GMT

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-18: CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).

CVEs: CVE-2026-59310

[high] Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability

Tue, 03 Mar 2026 00:00:00 GMT

Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. Added to CISA KEV on 2026-03-03.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-03-03: CISA added CVE-2026-22719 to the KEV catalog (due 2026-03-24).

CVEs: CVE-2026-22719

[high] Broadcom VMware Aria Operations and VMware Tools: VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

Thu, 30 Oct 2025 00:00:00 GMT

Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Added to CISA KEV on 2025-10-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-30: CISA added CVE-2025-41244 to the KEV catalog (due 2025-11-20).

CVEs: CVE-2025-41244

[critical] Marks & Spencer ransomware (Scattered Spider / DragonForce) halts online orders for 46 days

Tue, 10 Jun 2025 00:00:00 GMT

Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-06-10: Online clothing orders resume after 46 days (source)
2025-05-21: M&S estimates about £300M cost; disruption to last into July (source)
2025-04-29: Attack linked to Scattered Spider and DragonForce ransomware on ESXi (source)

[critical] VMware ESXi and Workstation: ESXi and Workstation TOCTOU Race Condition Vulnerability

Tue, 04 Mar 2025 00:00:00 GMT

VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. Added to CISA KEV on 2025-03-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-04: CISA added CVE-2025-22224 to the KEV catalog (due 2025-03-25).

CVEs: CVE-2025-22224

[critical] VMware ESXi: ESXi Arbitrary Write Vulnerability

Tue, 04 Mar 2025 00:00:00 GMT

VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox. Added to CISA KEV on 2025-03-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-04: CISA added CVE-2025-22225 to the KEV catalog (due 2025-03-25).

CVEs: CVE-2025-22225

[high] VMware ESXi, Workstation, and Fusion: ESXi, Workstation, and Fusion Information Disclosure Vulnerability

Tue, 04 Mar 2025 00:00:00 GMT

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process. Added to CISA KEV on 2025-03-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-04: CISA added CVE-2025-22226 to the KEV catalog (due 2025-03-25).

CVEs: CVE-2025-22226

[critical] VMware vCenter Server: 2 actively exploited vulnerabilities

Wed, 20 Nov 2024 00:00:00 GMT

CVE-2024-38812: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. CVE-2024-38813: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. Added to the CISA KEV catalog on 2024-11-20.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-11-20: CISA added CVE-2024-38812 to the KEV catalog (federal deadline 2024-12-11) (source)
2024-11-20: CISA added CVE-2024-38813 to the KEV catalog (federal deadline 2024-12-11) (source)
2024-09-17: CVE-2024-38812 published (source)

CVEs: CVE-2024-38812, CVE-2024-38813

[medium] VMware ESXi Authentication Bypass

Tue, 30 Jul 2024 00:00:00 GMT

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-07-30: CISA added CVE-2024-37085 to the KEV catalog (federal deadline 2024-08-20) (source)
2024-06-25: CVE-2024-37085 published (source)

CVEs: CVE-2024-37085

[medium] VMware vCenter Server Incorrect Default File Permissions

Wed, 17 Jul 2024 00:00:00 GMT

VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. Added to the CISA KEV catalog on 2024-07-17. CVE-2022-22948 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-07-17: CISA added CVE-2022-22948 to the KEV catalog (federal deadline 2024-08-07) (source)

CVEs: CVE-2022-22948

[critical] VMware vCenter Server Out-of-Bounds Write

Mon, 22 Jan 2024 00:00:00 GMT

VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-01-22. CVE-2023-34048 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-22: CISA added CVE-2023-34048 to the KEV catalog (federal deadline 2024-02-12) (source)

CVEs: CVE-2023-34048

[low] VMware Tools: Authentication Bypass (CVE-2023-20867)

Fri, 23 Jun 2023 00:00:00 GMT

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. Added to CISA KEV on 2023-06-23.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-23: CISA added CVE-2023-20867 to the KEV catalog (due 2023-07-14).

CVEs: CVE-2023-20867

[critical] VMware Aria Operations for Networks: Command Injection (CVE-2023-20887)

Thu, 22 Jun 2023 00:00:00 GMT

VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution. Added to CISA KEV on 2023-06-22.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-06-22: CISA added CVE-2023-20887 to the KEV catalog (due 2023-07-13).

CVEs: CVE-2023-20887