VMware Fusion

Name: VMware Fusion
Brand: VMware

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

EPSS ≥ 10%

critical

by severity

0critical22high16medium1low

updated 2026-10-27

vulnerabilities (55)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-59310US	—OT critical	2.56% (85th)	KEV	no fix	2026-07-30	≤ vers:unknown/*
CVE-2025-22226US	medium6.0OT critical	1.63% (76th)	KEV	no fix	2025-03-04	4 versions
CVE-2025-22224US	high8.2OT critical	1.56% (75th)	KEV	no fix	2025-03-04	3 versions
CVE-2025-22225US	high8.2OT critical	1.02% (63rd)	KEV	no fix	2025-03-04	4 versions
CVE-2026-59346US	—	0.41% (35th)	Exploit	26H1u1	2026-10-07	< 26H1u1
CVE-2026-22722US	—	0.17% (6th)	Exploit	25H2u1	2026-02-26	< 25H2u1
CVE-2017-4933US	high8.8	3.57% (89th)	—	no fix	2017-12-20	≤ 8.x before 8.5.9
CVE-2025-41239US	—	3.16% (88th)	—	13.6.4	2025-07-15	2 versions
CVE-2017-4941US	high8.8	3.16% (88th)	—	no fix	2017-12-20	≤ 8.x before 8.5.9
CVE-2018-6972US	medium6.5	2.96% (87th)	—	no fix	2018-07-25	≤ 10.x before 10.1.2
CVE-2025-41236US	—	2.61% (85th)	—	13.6.4	2025-07-15	2 versions
CVE-2019-5516US	medium6.8	1.67% (77th)	—	no fix	2019-04-15	2 versions
CVE-2018-6957US	medium5.3	1.59% (75th)	—	no fix	2018-03-15	2 versions
CVE-2019-5517US	medium6.8	1.11% (66th)	—	no fix	2019-04-15	2 versions
CVE-2019-5520US	medium5.9	1.04% (64th)	—	no fix	2019-04-15	2 versions
CVE-2020-3947US	high8.8	0.61% (49th)	—	no fix	2020-03-16	≤ 11.x before 11.5.2
CVE-2026-59309US	—	0.61% (49th)	—	no fix	2026-07-30	≤ vers:unknown/*
CVE-2017-4924US	high8.8	0.61% (49th)	—	no fix	2017-09-15	≤ 8.x before 8.5.8
CVE-2020-3962US	high8.2	0.60% (48th)	—	no fix	2020-06-24	≤ 11.x before 11.5.5
CVE-2020-3968US	high8.2	0.60% (48th)	—	no fix	2020-06-25	≤ 11.x before 11.5.5
CVE-2020-3965US	medium5.5	0.56% (47th)	—	no fix	2020-06-25	≤ 11.x before 11.5.2
CVE-2020-3963US	medium5.5	0.55% (46th)	—	no fix	2020-06-25	≤ 11.x before 11.5.2
CVE-2020-3969US	high7.8	0.52% (44th)	—	no fix	2020-06-24	≤ 11.x before 11.5.5
CVE-2018-6973US	high8.8	0.49% (42nd)	—	no fix	2018-08-15	≤ 10.x before 10.1.3
CVE-2020-3967US	high7.5	0.49% (42nd)	—	no fix	2020-06-25	≤ 11.x before 11.5.5
CVE-2018-6974US	high8.8	0.47% (41st)	—	no fix	2018-10-16	≤ 10.x before 10.1.3
CVE-2020-3964US	medium4.7	0.47% (41st)	—	no fix	2020-06-25	≤ 11.x before 11.5.2
CVE-2025-41238US	—	0.46% (40th)	—	13.6.4	2025-07-15	2 versions
CVE-2025-41237US	—	0.46% (40th)	—	13.6.4	2025-07-15	2 versions
CVE-2017-4934US	high8.8	0.44% (38th)	—	no fix	2017-11-17	≤ 8.x before 8.5.9
CVE-2017-4945US	medium5.5	0.43% (37th)	—	no fix	2018-01-05	2 versions
CVE-2026-41703US	—	0.43% (37th)	—	26H1	2026-07-30	2 versions
CVE-2018-6977US	medium6.5	0.43% (37th)	—	no fix	2018-10-09	≤ 11.x and 10.x
CVE-2018-6962US	high7.8	0.41% (35th)	—	no fix	2018-05-22	≤ 10.x before 10.1.2
CVE-2020-3970US	low3.8	0.40% (34th)	—	no fix	2020-06-25	≤ 11.x before 11.5.5
CVE-2018-6963US	medium5.5	0.40% (34th)	—	no fix	2018-05-22	≤ 10.x before 10.1.2
CVE-2017-4925US	medium5.5	0.38% (32nd)	—	no fix	2017-09-15	≤ 8.x before 8.5.4
CVE-2017-4950US	high7.0	0.38% (32nd)	—	no fix	2018-01-11	2 versions
CVE-2020-3966US	high7.5	0.38% (31st)	—	no fix	2020-06-25	≤ 11.x before 11.5.2
CVE-2017-4949US	high7.0	0.37% (31st)	—	no fix	2018-01-11	2 versions
CVE-2017-4938US	medium6.5	0.37% (30th)	—	no fix	2017-11-17	≤ 8.x before 8.5.9
CVE-2020-3971US	medium5.5	0.35% (28th)	—	no fix	2020-06-25	≤ 11.x before 11.0.2
CVE-2026-41709US	—	0.30% (22nd)	—	no fix	2026-07-30	≤ vers:unknown/*
CVE-2020-3948US	high7.8	0.28% (21st)	—	no fix	2020-03-16	≤ 11.x before 11.5.2
CVE-2024-38811US	high7.8	0.28% (20th)	—	13.6	2024-09-03	< 13.6
CVE-2026-59347US	—	0.23% (14th)	—	26H1u1	2026-10-07	< 26H1u1
CVE-2026-22715US	—	0.22% (12th)	—	25H2u1	2026-02-26	3 versions
CVE-2023-34044US	medium6.0	0.20% (9th)	—	13.5	2023-10-20	13.x → 13.5
CVE-2026-22717US	—	0.19% (9th)	—	25H2u1	2026-02-27	< 25H2u1
CVE-2026-47876US	—	0.19% (9th)	—	no fix	2026-07-30	≤ vers:unknown/*

showing 50 of 55

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-787Out-of-bounds Write12 CVEs
CWE-125Out-of-bounds Read10 CVEs
CWE-476NULL Pointer Dereference5 CVEs
CWE-416Use After Free4 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer3 CVEs
CWE-190Integer Overflow or Wraparound3 CVEs
CWE-269Improper Privilege Management3 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')3 CVEs

sources (3)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)42 CVEs
DECERT-Bund (BSI CSAF)15 CVEs
NLNCSC-NL (CSAF)8 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan