VMware Cloud Foundation

Name: VMware Cloud Foundation
Brand: VMware

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

4critical4high6medium0low

updated 2026-10-26

vulnerabilities (46)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-59310US	—OT critical	2.56% (85th)	KEV	no fix	2026-07-30	3 versions
CVE-2024-38812US	critical9.8OT critical	54.6% (99th)	KEV	7.0 U3t	2024-09-17	3 versions
CVE-2026-22719US	—OT critical	18.3% (97th)	KEV	9.0.2.0	2026-02-25	2 versions
CVE-2024-38813US	critical9.8OT critical	17.4% (97th)	KEV	8.0 U3d	2024-09-17	3 versions
CVE-2025-22226US	medium6.0OT critical	1.77% (78th)	KEV	no fix	2025-03-04	6 versions
CVE-2025-22224US	high8.2OT critical	1.56% (75th)	KEV	no fix	2025-03-04	6 versions
CVE-2025-22225US	high8.2OT critical	1.02% (63rd)	KEV	no fix	2025-03-04	6 versions
CVE-2025-41228US	—	0.90% (59th)	Exploit	8.0 U3e	2025-05-20	4 versions
CVE-2025-41239US	—	3.16% (88th)	—	ESXi80U3f-24784735	2025-07-15	3 versions
CVE-2025-41236US	—	2.61% (85th)	—	ESXi80U3f-24784735	2025-07-15	3 versions
CVE-2025-41251US	—	0.80% (56th)	—	5.2.2	2025-09-29	2 versions
CVE-2026-22721US	high7.2	0.74% (54th)	—	9.0.2.0	2026-02-25	2 versions
CVE-2025-41252US	—	0.69% (52nd)	—	5.2.2	2025-09-29	2 versions
CVE-2025-22218US	high7.7	0.68% (52nd)	—	KB92148	2025-01-30	< KB92148
CVE-2025-41229US	—	0.68% (52nd)	—	5.2.1.2	2025-05-20	6 versions
CVE-2025-22219US	critical9.0	0.67% (51st)	—	KB92148	2025-01-30	< KB92148
CVE-2025-41250US	—	0.66% (51st)	—	9.0.1.0	2025-09-29	5 versions
CVE-2026-59309US	—	0.61% (49th)	—	no fix	2026-07-30	3 versions
CVE-2025-41245US	—OT elevated	0.61% (48th)	—	9.0.1.0	2025-09-29	< 9.0.1.0
CVE-2025-22222US	medium6.5	0.56% (46th)	—	KB92148	2025-01-30	< KB92148
CVE-2024-38817US	—	0.52% (43rd)	—	4.2.1	2024-10-09	< 4.2.1
CVE-2025-41238US	—	0.46% (39th)	—	ESXi80U3f-24784735	2025-07-15	3 versions
CVE-2025-41237US	—	0.46% (39th)	—	ESXi80U3f-24784735	2025-07-15	3 versions
CVE-2026-22720US	critical9.0	0.45% (38th)	—	9.0.2.0	2026-02-25	2 versions
CVE-2025-41230US	—	0.43% (37th)	—	5.2.1.2	2025-05-20	6 versions
CVE-2026-41703US	—	0.43% (37th)	—	5.2.3	2026-07-30	3 versions
CVE-2026-41723US	—	0.42% (35th)	—	9.0.2.0 EP2	2026-06-08	2 versions
CVE-2025-22221US	medium4.8	0.40% (33rd)	—	KB92148	2025-01-30	< KB92148
CVE-2025-22249US	—	0.36% (28th)	—	KB394224	2025-05-13	< KB394224
CVE-2025-22243US	—	0.34% (26th)	—	NSX Async Patch 4.2.2.1	2025-06-04	2 versions
CVE-2025-22220US	medium5.4	0.33% (25th)	—	KB92148	2025-01-30	< KB92148
CVE-2024-38815US	—	0.32% (24th)	—	4.2.1	2024-10-09	< 4.2.1
CVE-2026-41724US	medium5.4	0.32% (23rd)	—	9.0.2.0 EP2	2026-06-08	2 versions
CVE-2026-41722US	medium5.4	0.32% (23rd)	—	9.0.2.0 EP2	2026-06-08	2 versions
CVE-2025-41241US	—	0.32% (23rd)	—	7.0 U3v	2025-07-29	3 versions
CVE-2025-22244US	—	0.31% (23rd)	—	NSX Async Patch 4.2.2.1	2025-06-04	2 versions
CVE-2026-41709US	—	0.30% (21st)	—	5.2.4	2026-07-30	3 versions
CVE-2024-38818US	—	0.29% (20th)	—	4.2.1	2024-10-09	< 4.2.1
CVE-2025-41246US	—OT elevated	0.28% (19th)	—	9.0.1.0	2025-09-29	< 9.0.1.0
CVE-2025-22215US	—	0.26% (17th)	—	KB 385294	2025-01-08	< KB 385294
CVE-2025-22245US	—	0.26% (17th)	—	NSX Async Patch 4.1.2.6	2025-06-04	2 versions
CVE-2025-41225US	—	0.26% (17th)	—	8.0 U3e	2025-05-20	3 versions
CVE-2025-41226US	—	0.24% (15th)	—	ESXi70U3sv-24723868	2025-05-20	4 versions
CVE-2026-47876US	—	0.19% (8th)	—	no fix	2026-07-30	3 versions
CVE-2025-41231US	—OT elevated	0.17% (6th)	—	5.2.1.2	2025-05-20	4 versions
CVE-2025-41227US	—	0.17% (5th)	—	ESXi80U3se-24659227	2025-05-20	4 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')12 CVEs
CWE-787Out-of-bounds Write6 CVEs
CWE-269Improper Privilege Management4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')3 CVEs
CWE-125Out-of-bounds Read2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs

sources (3)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)41 CVEs
EUEU Vulnerability Database (ENISA)15 CVEs
NLNCSC-NL (CSAF)13 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan