Email, files and business apps

VMware (Broadcom) security incident history

Updated Oct 26, 2026. Data gathered daily from official public sources.

As of Oct 26, 2026, Vendor History found 34 actively exploited security flaws for VMware (Broadcom), dated Nov 3, 2021 to Aug 18, 2026. Sources checked: the California and Washington Attorney General breach lists, SEC EDGAR (Form 8-K, Item 1.05) and CISA's Known Exploited Vulnerabilities catalog.

Breach notices and SEC cyber filings

None found in the sources we check.

Got a breach letter from VMware (Broadcom)? What to do when a vendor has a data breach.

Actively exploited security flaws

Flaws in VMware (Broadcom) products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.

1. Aug 18, 2026Exploited flaw

   Broadcom VMware vCenter Path Traversal Vulnerability (CVE-2026-59310). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

2. Mar 3, 2026Exploited flaw

   Broadcom VMware Aria Operations Command Injection Vulnerability (CVE-2026-22719). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

3. Jan 23, 2026Exploited flaw

   Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability (CVE-2024-37079). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

4. Oct 30, 2025Exploited flaw

   Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability (CVE-2025-41244). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

5. Apr 28, 2025Exploited flaw

   Broadcom Brocade Fabric OS Code Injection Vulnerability (CVE-2025-1976). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

6. Mar 4, 2025Exploited flaw

   VMware ESXi and Workstation TOCTOU Race Condition Vulnerability (CVE-2025-22224). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

7. Mar 4, 2025Exploited flaw

   VMware ESXi Arbitrary Write Vulnerability (CVE-2025-22225). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

   Source: CISA Known Exploited Vulnerabilities catalog

8. Mar 4, 2025Exploited flaw

   VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability (CVE-2025-22226). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

9. Nov 20, 2024Exploited flaw

   VMware vCenter Server Heap-Based Buffer Overflow Vulnerability (CVE-2024-38812). Added to CISA's list of security flaws known to be exploited by attackers.

   Source: CISA Known Exploited Vulnerabilities catalog

10. Nov 20, 2024Exploited flaw

    VMware vCenter Server Privilege Escalation Vulnerability (CVE-2024-38813). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

11. Jul 30, 2024Exploited flaw

    VMware ESXi Authentication Bypass Vulnerability (CVE-2024-37085). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

12. Jul 17, 2024Exploited flaw

    VMware vCenter Server Incorrect Default File Permissions Vulnerability (CVE-2022-22948). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

13. Jan 22, 2024Exploited flaw

    VMware vCenter Server Out-of-Bounds Write Vulnerability (CVE-2023-34048). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

14. Jun 23, 2023Exploited flaw

    VMware Tools Authentication Bypass Vulnerability (CVE-2023-20867). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

15. Jun 22, 2023Exploited flaw

    Vmware Aria Operations for Networks Command Injection Vulnerability (CVE-2023-20887). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

16. Aug 25, 2022Exploited flaw

    VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability (CVE-2022-22963). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

17. May 16, 2022Exploited flaw

    VMware Spring Cloud Gateway Code Injection Vulnerability (CVE-2022-22947). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

18. Apr 15, 2022Exploited flaw

    VMware Multiple Products Privilege Escalation Vulnerability (CVE-2022-22960). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

19. Apr 14, 2022Exploited flaw

    VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability (CVE-2022-22954). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

20. Apr 4, 2022Exploited flaw

    Spring Framework JDK 9+ Remote Code Execution Vulnerability (CVE-2022-22965). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

21. Mar 25, 2022Exploited flaw

    VMware Tanzu Spring Data Commons Property Binder Vulnerability (CVE-2018-1273). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

22. Mar 25, 2022Exploited flaw

    VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability (CVE-2018-6961). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

23. Mar 25, 2022Exploited flaw

    VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability (CVE-2020-5410). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

24. Mar 7, 2022Exploited flaw

    VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability (CVE-2021-21973). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

25. Jan 18, 2022Exploited flaw

    VMware Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

26. Jan 10, 2022Exploited flaw

    VMware vCenter Server Improper Access Control (CVE-2021-22017). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

27. Nov 3, 2021Exploited flaw

    VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability (CVE-2019-5544). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

28. Nov 3, 2021Exploited flaw

    VMware Multiple Products Privilege Escalation Vulnerability (CVE-2020-3950). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

29. Nov 3, 2021Exploited flaw

    VMware vCenter Server Information Disclosure Vulnerability (CVE-2020-3952). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

30. Nov 3, 2021Exploited flaw

    VMware ESXi OpenSLP Use-After-Free Vulnerability (CVE-2020-3992). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

31. Nov 3, 2021Exploited flaw

    Multiple VMware Products Command Injection Vulnerability (CVE-2020-4006). Added to CISA's list of security flaws known to be exploited by attackers.

    Source: CISA Known Exploited Vulnerabilities catalog

32. Nov 3, 2021Exploited flaw

    VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21972). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

33. Nov 3, 2021Exploited flaw

    VMware vCenter Server Improper Input Validation Vulnerability (CVE-2021-21985). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

34. Nov 3, 2021Exploited flaw

    VMware vCenter Server File Upload Vulnerability (CVE-2021-22005). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.

    Source: CISA Known Exploited Vulnerabilities catalog

We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works

To cite: Vendor History, "VMware (Broadcom) security incident history," vendorhistory.com/vendor/vmware, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.