# VMware vulnerabilities Source: https://junglewise.ai/threats/vendors/vmware Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/vmware.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 226 vulnerabilities in VMware: 0 in the last 7 days and 73 in the last 90 days, 42 of them critical and 30 exploited in the wild. The most recent, CVE-2026-67418, was published on 14 October 2026. 3 vulnerabilities in the last four weeks, down 90% on the four before (30). 0 critical against 1. 26 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 73 - All time: 226 (42 critical, 30 exploited in the wild) ## About VMware Provider of virtualization, cloud computing, and enterprise software solutions. ## Latest VMware vulnerabilities - [CVE-2026-67418: RabbitMQ MQTT 5 parser invalid property denial of service](https://junglewise.ai/threats/cve-2026-67418-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 14 Oct 2026) - [CVE-2026-67416: RabbitMQ AMQP 1.0 parser descriptor validation bypass](https://junglewise.ai/threats/cve-2026-67416-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0) (info, published 14 Oct 2026) - [CVE-2026-67414: RabbitMQ AMQP 1.0 parser memory exhaustion](https://junglewise.ai/threats/cve-2026-67414-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0) (info, published 14 Oct 2026) - [CVE-2026-59347: VMware Workstation and Fusion stack buffer overflow in HGFS](https://junglewise.ai/threats/cve-2026-59347-vmware-workstation-and-fusion-contain-a-stack-based-buffer) (high, CVSS 8.1, published 7 Oct 2026) - [CVE-2026-59346: VMware Workstation and Fusion integer overflow in VMXNET3](https://junglewise.ai/threats/cve-2026-59346-vmware-workstation-and-fusion-contain-an-integer-overflow) (critical, CVSS 9.3, published 7 Oct 2026) - [CVE-2026-67421: RabbitMQ Management XSS via queue name in OAuth UI](https://junglewise.ai/threats/cve-2026-67421-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67413: RabbitMQ JMS topic exchange denial of service via regex wildcard expansion](https://junglewise.ai/threats/cve-2026-67413-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0) (info, published 25 Sep 2026) - [CVE-2026-67412: RabbitMQ Federation upstream authorization bypass](https://junglewise.ai/threats/cve-2026-67412-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-4) (info, published 25 Sep 2026) - [CVE-2026-67408: RabbitMQ denial of service in Stream Management super-stream binding](https://junglewise.ai/threats/cve-2026-67408-rabbitmq-is-a-messaging-and-streaming-broker-from-4-1-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67407: RabbitMQ MQTT topic permission bypass in regex escaping](https://junglewise.ai/threats/cve-2026-67407-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67242: RabbitMQ OAuth2 token expiry bypass for fractional exp](https://junglewise.ai/threats/cve-2026-67242-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67226: RabbitMQ atom exhaustion in user tags management](https://junglewise.ai/threats/cve-2026-67226-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0) (info, published 25 Sep 2026) - [CVE-2026-67225: RabbitMQ stream protocol frame size validation bypass](https://junglewise.ai/threats/cve-2026-67225-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67222: RabbitMQ list_to_atom denial of service in auth_mechanism](https://junglewise.ai/threats/cve-2026-67222-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-66078: RabbitMQ protected tag bypass in bulk-delete endpoint](https://junglewise.ai/threats/cve-2026-66078-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-66073: RabbitMQ atom table exhaustion in management API](https://junglewise.ai/threats/cve-2026-66073-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-66071: RabbitMQ atom exhaustion in OAuth2 JWT scope parsing](https://junglewise.ai/threats/cve-2026-66071-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67236: RabbitMQ insecure authentication cookie in management console](https://junglewise.ai/threats/cve-2026-67236-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67233: RabbitMQ authorization bypass in shovel management resource](https://junglewise.ai/threats/cve-2026-67233-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 24 Sep 2026) - [CVE-2026-67405: RabbitMQ missing Origin header validation in WebSocket upgrade](https://junglewise.ai/threats/cve-2026-67405-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67404: RabbitMQ OAuth2 JWKS signature verification bypass](https://junglewise.ai/threats/cve-2026-67404-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67235: RabbitMQ unvalidated content-header BodySize memory exhaustion](https://junglewise.ai/threats/cve-2026-67235-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) - [CVE-2026-67231: RabbitMQ trust-store plugin TLS client authentication bypass](https://junglewise.ai/threats/cve-2026-67231-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67229: RabbitMQ denial of service in vhost metadata import](https://junglewise.ai/threats/cve-2026-67229-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67228: RabbitMQ atom table exhaustion denial of service in runtime-parameters](https://junglewise.ai/threats/cve-2026-67228-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) ## Most severe VMware vulnerabilities - [CVE-2024-37079: Broadcom VMware vCenter Server out-of-bounds write in DCERPC protocol](https://junglewise.ai/threats/cve-2024-37079-broadcom-vmware-vcenter-server-out-of-bounds-write-in-dcerpc) (critical, exploited in the wild, CVSS 9.8, published 23 Jan 2026) - [CVE-2026-59310: VMware vCenter directory traversal in Syslog server](https://junglewise.ai/threats/cve-2026-59310-vmware-vcenter-directory-traversal-in-syslog-server) (critical, exploited in the wild, CVSS 9.8, published 30 Jul 2026) - [CVE-2024-38813: VMware vCenter Server Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2024-38813-vmware-vcenter-server-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 20 Nov 2024) - [CVE-2024-38812: VMware vCenter Server Heap-Based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2024-38812-vmware-vcenter-server-heap-based-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 20 Nov 2024) - [CVE-2023-34048: VMware vCenter Server Out-of-Bounds Write Vulnerability](https://junglewise.ai/threats/cve-2023-34048-vmware-vcenter-server-out-of-bounds-write-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 22 Jan 2024) - [CVE-2023-20887: Vmware Aria Operations for Networks Command Injection Vulnerability](https://junglewise.ai/threats/cve-2023-20887-vmware-aria-operations-for-networks-command-injection) (critical, exploited in the wild, CVSS 9.8, published 22 Jun 2023) - [CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability](https://junglewise.ai/threats/cve-2022-22954-vmware-workspace-one-access-and-identity-manager-server-side) (critical, exploited in the wild, CVSS 9.8, published 14 Apr 2022) - [CVE-2021-22005: VMware vCenter Server File Upload Vulnerability](https://junglewise.ai/threats/cve-2021-22005-vmware-vcenter-server-file-upload-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2019-5544: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2019-5544-vmware-esxi-and-horizon-daas-openslp-heap-based-buffer-overflow) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2021-21972: VMware vCenter Server Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2021-21972-vmware-vcenter-server-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 90% on the four before (30). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 0 | 0 | | 24 Aug 2026 | 37 | 4 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 27 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 1 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## VMware technologies - [VMware RabbitMQ](https://junglewise.ai/threats/technologies/vmware-rabbitmq): 30 vulnerabilities - [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework): 26 vulnerabilities - [VMware Cloud Foundation](https://junglewise.ai/threats/technologies/cloud-foundation): 21 vulnerabilities - [VMware Spring AI](https://junglewise.ai/threats/technologies/spring-ai): 20 vulnerabilities - [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security): 19 vulnerabilities - [VMware ESXi](https://junglewise.ai/threats/technologies/esxi): 11 vulnerabilities - [VMware Spring Boot](https://junglewise.ai/threats/technologies/spring-boot): 11 vulnerabilities - [VMware Fusion](https://junglewise.ai/threats/technologies/fusion): 8 vulnerabilities - [VMware Avi Load Balancer](https://junglewise.ai/threats/technologies/avi-load-balancer): 7 vulnerabilities - [VMware Spring for GraphQL](https://junglewise.ai/threats/technologies/spring-for-graphql): 7 vulnerabilities - [VMware Spring Integration](https://junglewise.ai/threats/technologies/spring-integration): 7 vulnerabilities - [VMware vSphere Foundation](https://junglewise.ai/threats/technologies/vsphere-foundation): 7 vulnerabilities - [VMware Spring Web Services](https://junglewise.ai/threats/technologies/web-services): 7 vulnerabilities - [VMware Workstation](https://junglewise.ai/threats/technologies/workstation): 7 vulnerabilities - [VMware Spring Cloud Function](https://junglewise.ai/threats/technologies/spring-cloud-function): 6 vulnerabilities - [VMware Spring Data REST](https://junglewise.ai/threats/technologies/spring-data-rest): 6 vulnerabilities - [VMware Spring Cloud Config](https://junglewise.ai/threats/technologies/spring-cloud-config): 5 vulnerabilities - [VMware Reactor Netty](https://junglewise.ai/threats/technologies/reactor-netty): 4 vulnerabilities - [VMware Spring AMQP](https://junglewise.ai/threats/technologies/spring-amqp): 4 vulnerabilities - [VMware Spring Cloud Gateway](https://junglewise.ai/threats/technologies/spring-cloud-gateway): 4 vulnerabilities - [VMware Cloud Foundation Operations](https://junglewise.ai/threats/technologies/cloud-foundation-operations): 3 vulnerabilities - [VMware Identity Manager](https://junglewise.ai/threats/technologies/identity-manager): 3 vulnerabilities - [VMware Spring Authorization Server](https://junglewise.ai/threats/technologies/spring-authorization-server): 3 vulnerabilities - [VMware Spring Cloud Stream](https://junglewise.ai/threats/technologies/spring-cloud-stream): 3 vulnerabilities - [VMware Spring for Apache Kafka](https://junglewise.ai/threats/technologies/spring-for-apache-kafka): 3 vulnerabilities - [VMware Workspace ONE Access](https://junglewise.ai/threats/technologies/workspace-one-access): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "VMware vulnerabilities", https://junglewise.ai/threats/vendors/vmware, 9 November 2026.