VMware Workstation

Name: VMware Workstation
Brand: VMware

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

EPSS ≥ 10%

critical

by severity

0critical26high16medium1low

updated 2026-10-27

vulnerabilities (59)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-59310US	—OT critical	2.56% (85th)	KEV	no fix	2026-07-30	≤ vers:unknown/*
CVE-2025-22226US	medium6.0OT critical	1.63% (76th)	KEV	no fix	2025-03-04	4 versions
CVE-2025-22224US	high8.2OT critical	1.56% (75th)	KEV	17.6.3	2025-03-04	5 versions
CVE-2025-22225US	high8.2OT critical	1.02% (63rd)	KEV	no fix	2025-03-04	3 versions
CVE-2026-59346US	—	0.41% (35th)	Exploit	26H1u1	2026-10-07	< 26H1u1
CVE-2026-22722US	—	0.17% (6th)	Exploit	25H2u1	2026-02-26	3 versions
CVE-2017-4933US	high8.8	3.57% (89th)	—	no fix	2017-12-20	≤ 12.x before 12.5.8
CVE-2025-41239US	—	3.16% (88th)	—	17.6.4	2025-07-15	2 versions
CVE-2017-4941US	high8.8	3.16% (88th)	—	no fix	2017-12-20	≤ 12.x before 12.5.8
CVE-2018-6972US	medium6.5	2.96% (87th)	—	no fix	2018-07-25	≤ 14.x before 14.1.2
CVE-2025-41236US	—	2.61% (85th)	—	17.6.4	2025-07-15	2 versions
CVE-2019-5516US	medium6.8	1.67% (77th)	—	no fix	2019-04-15	2 versions
CVE-2018-6957US	medium5.3	1.59% (75th)	—	no fix	2018-03-15	2 versions
CVE-2017-4939US	high7.8	1.34% (71st)	—	no fix	2017-11-17	≤ 12.x before 12.5.8
CVE-2019-5517US	medium6.8	1.11% (66th)	—	no fix	2019-04-15	2 versions
CVE-2019-5520US	medium5.9	1.04% (64th)	—	no fix	2019-04-15	2 versions
CVE-2020-3947US	high8.8	0.61% (49th)	—	no fix	2020-03-16	≤ 15.x before 15.5.2
CVE-2026-59309US	—	0.61% (49th)	—	no fix	2026-07-30	≤ vers:unknown/*
CVE-2017-4924US	high8.8	0.61% (49th)	—	no fix	2017-09-15	≤ 12.x before 12.5.7
CVE-2020-3962US	high8.2	0.60% (48th)	—	no fix	2020-06-24	≤ 15.x before 15.5.5
CVE-2020-3968US	high8.2	0.60% (48th)	—	no fix	2020-06-25	≤ 15.x before 15.5.5
CVE-2020-3965US	medium5.5	0.56% (47th)	—	no fix	2020-06-25	≤ 15.x before 15.5.2
CVE-2020-3963US	medium5.5	0.55% (46th)	—	no fix	2020-06-25	≤ 15.x before 15.5.2
CVE-2020-3969US	high7.8	0.52% (44th)	—	no fix	2020-06-24	≤ 15.x before 15.5.5
CVE-2018-6973US	high8.8	0.49% (42nd)	—	no fix	2018-08-15	≤ 14.x before 14.1.3
CVE-2020-3967US	high7.5	0.49% (42nd)	—	no fix	2020-06-25	≤ 15.x before 15.5.5
CVE-2018-6974US	high8.8	0.47% (41st)	—	no fix	2018-10-16	≤ 14.x before 14.1.3
CVE-2020-3964US	medium4.7	0.47% (41st)	—	no fix	2020-06-25	≤ 15.x before 15.5.2
CVE-2025-41238US	—	0.46% (40th)	—	17.6.4	2025-07-15	2 versions
CVE-2025-41237US	—	0.46% (40th)	—	17.6.4	2025-07-15	2 versions
CVE-2017-4934US	high8.8	0.44% (38th)	—	no fix	2017-11-17	≤ 12.x before 12.5.8
CVE-2017-4945US	medium5.5	0.43% (37th)	—	no fix	2018-01-05	2 versions
CVE-2026-41703US	—	0.43% (37th)	—	26H1	2026-07-30	2 versions
CVE-2018-6977US	medium6.5	0.43% (37th)	—	no fix	2018-10-09	≤ 15.x and 14.x
CVE-2017-4948US	high7.1	0.41% (35th)	—	no fix	2018-01-05	2 versions
CVE-2020-3970US	low3.8	0.40% (34th)	—	no fix	2020-06-25	≤ 15.x before 15.5.5
CVE-2018-6963US	medium5.5	0.40% (34th)	—	no fix	2018-05-22	≤ 14.x before 14.1.2
CVE-2017-4937US	high7.8	0.39% (33rd)	—	no fix	2017-11-17	≤ 12.x before 12.5.8
CVE-2017-4936US	high7.8	0.39% (33rd)	—	no fix	2017-11-17	≤ 12.x before 12.5.8
CVE-2017-4935US	high7.8	0.39% (33rd)	—	no fix	2017-11-17	≤ 12.x before 12.5.8
CVE-2017-4913US	high7.8	0.39% (33rd)	—	no fix	2017-06-08	≤ 12.x prior to 12.5.3
CVE-2017-4925US	medium5.5	0.38% (32nd)	—	no fix	2017-09-15	≤ 12.x before 12.5.3
CVE-2020-3966US	high7.5	0.38% (31st)	—	no fix	2020-06-25	≤ 15.x before 15.5.2
CVE-2017-4912US	high7.8	0.37% (31st)	—	no fix	2017-06-08	≤ 12.x prior to 12.5.3
CVE-2017-4911US	high7.8	0.37% (31st)	—	no fix	2017-06-08	≤ 12.x prior to 12.5.3
CVE-2017-4910US	high7.8	0.37% (31st)	—	no fix	2017-06-08	≤ 12.x prior to 12.5.3
CVE-2017-4909US	high7.8	0.37% (31st)	—	no fix	2017-06-08	≤ 12.x prior to 12.5.3
CVE-2017-4908US	high7.8	0.37% (31st)	—	no fix	2017-06-08	≤ 12.x prior to 12.5.3
CVE-2017-4938US	medium6.5	0.37% (30th)	—	no fix	2017-11-17	≤ 12.x before 12.5.8
CVE-2020-3971US	medium5.5	0.35% (28th)	—	no fix	2020-06-25	≤ 15.x before 15.0.2

showing 50 of 59

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read15 CVEs
CWE-787Out-of-bounds Write14 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer5 CVEs
CWE-476NULL Pointer Dereference5 CVEs
CWE-190Integer Overflow or Wraparound3 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-416Use After Free3 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2 CVEs

sources (3)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)51 CVEs
DECERT-Bund (BSI CSAF)13 CVEs
NLNCSC-NL (CSAF)8 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan