VMware VMware ESXi

Name: VMware VMware ESXi
Brand: VMware

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

1critical5high6medium2low

updated 2026-10-28

vulnerabilities (14)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-5521US	critical9.6	1.63% (76th)	—	no fix	2019-09-20	2 versions
CVE-2020-3962US	high8.2	0.60% (48th)	—	no fix	2020-06-24	3 versions
CVE-2020-3968US	high8.2	0.60% (48th)	—	no fix	2020-06-25	3 versions
CVE-2020-3965US	medium5.5	0.56% (47th)	—	no fix	2020-06-25	3 versions
CVE-2020-3963US	medium5.5	0.55% (46th)	—	no fix	2020-06-25	3 versions
CVE-2020-3969US	high7.8	0.52% (44th)	—	no fix	2020-06-24	3 versions
CVE-2020-3967US	high7.5	0.49% (42nd)	—	no fix	2020-06-25	3 versions
CVE-2020-3964US	medium4.7	0.47% (41st)	—	no fix	2020-06-25	3 versions
CVE-2020-3958US	medium5.5	0.47% (40th)	—	no fix	2020-05-29	2 versions
CVE-2018-6982US	medium6.5	0.45% (39th)	—	no fix	2018-12-04	≤ VMware ESXi 6.7 without ESXi670-201811401-BG, VMware ESXi 6.5 without ESXi650-201811301-BG
CVE-2020-3970US	low3.8	0.40% (34th)	—	no fix	2020-06-25	3 versions
CVE-2020-3966US	high7.5	0.38% (32nd)	—	no fix	2020-06-25	3 versions
CVE-2020-3971US	medium5.5	0.35% (28th)	—	no fix	2020-06-25	2 versions
CVE-2020-3959US	low3.3	0.32% (24th)	—	no fix	2020-05-29	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read3 CVEs
CWE-787Out-of-bounds Write3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-416Use After Free2 CVEs
CWE-908Use of Uninitialized Resource2 CVEs
CWE-193Off-by-one Error1 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.