VMware ESXi

Name: VMware ESXi
Brand: VMware

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

1critical10high10medium0low

updated 2026-10-27

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-37085US	high7.2OT critical	26.8% (98th)	KEV	ESXi80U3-24022510	2024-06-25	< ESXi80U3-24022510
CVE-2025-22226US	medium6.0OT critical	1.63% (76th)	KEV	no fix	2025-03-04	11 versions
CVE-2025-22224US	high8.2OT critical	1.56% (75th)	KEV	ESXi80U3d-24585383	2025-03-04	14 versions
CVE-2025-22225US	high8.2OT critical	1.02% (63rd)	KEV	no fix	2025-03-04	11 versions
CVE-2017-4905US	medium5.5	1.20% (68th)	Exploit	no fix	2017-06-07	5 versions
CVE-2025-41228US	—	0.90% (59th)	Exploit	ESXi70U3sv-24723868	2025-05-20	2 versions
CVE-2017-4933US	high8.8	3.57% (89th)	—	no fix	2017-12-20	≤ 6.5 before ESXi650-201710401-BG
CVE-2025-41239US	—	3.16% (88th)	—	ESXi80U2e-24789317	2025-07-15	6 versions
CVE-2017-4941US	high8.8	3.16% (88th)	—	no fix	2017-12-20	2 versions
CVE-2018-6972US	medium6.5	2.96% (87th)	—	no fix	2018-07-25	4 versions
CVE-2025-41236US	—	2.63% (85th)	—	ESXi80U3f-24784735	2025-07-15	6 versions
CVE-2019-5528US	medium5.3	1.70% (77th)	—	no fix	2019-07-11	≤ ESXi 6.5 without patch ESXi650-201907201-UG
CVE-2019-5516US	medium6.8	1.67% (77th)	—	no fix	2019-04-15	2 versions
CVE-2020-3955US	critical9.3	1.34% (71st)	—	no fix	2020-04-29	2 versions
CVE-2019-5517US	medium6.8	1.11% (66th)	—	no fix	2019-04-15	2 versions
CVE-2019-5520US	medium5.9	1.04% (64th)	—	no fix	2019-04-15	2 versions
CVE-2017-4940US	medium6.1	0.91% (60th)	—	no fix	2017-12-20	3 versions
CVE-2017-4924US	high8.8	0.61% (49th)	—	no fix	2017-09-15	≤ 6.5 without patch ESXi650-201707101-SG
CVE-2017-4902US	high8.8	0.52% (44th)	—	no fix	2017-06-07	2 versions
CVE-2018-6974US	high8.8	0.47% (41st)	—	no fix	2018-10-16	3 versions
CVE-2025-41238US	—	0.46% (40th)	—	ESXi80U2e-24789317	2025-07-15	6 versions
CVE-2025-41237US	—	0.46% (40th)	—	ESXi70U3w-24784741	2025-07-15	6 versions
CVE-2017-4904US	high8.8	0.43% (37th)	—	no fix	2017-06-07	5 versions
CVE-2018-6977US	medium6.5	0.43% (37th)	—	no fix	2018-10-09	≤ 6.7, 6.5, 6.0
CVE-2017-4903US	high8.8	0.41% (35th)	—	no fix	2017-06-07	5 versions
CVE-2017-4925US	medium5.5	0.38% (32nd)	—	no fix	2017-09-15	3 versions
CVE-2025-41226US	—	0.24% (15th)	—	ESXi80U3se-24659227	2025-05-20	4 versions
CVE-2024-37086US	—	0.19% (9th)	—	ESXi80U3-24022510	2024-06-25	2 versions
CVE-2025-41227US	—	0.17% (6th)	—	ESXi80U3se-24659227	2025-05-20	4 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read6 CVEs
CWE-787Out-of-bounds Write6 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer5 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-476NULL Pointer Dereference2 CVEs
CWE-908Use of Uninitialized Resource2 CVEs
CWE-123Write-what-where Condition1 CVEs

sources (3)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)24 CVEs
DECERT-Bund (BSI CSAF)12 CVEs
NLNCSC-NL (CSAF)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan