Skip to content
BackEsc
Connect AISign inSign up free

VMware · weakness class

File and Path Handling

50 CVEs · 3 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Connect AI

exploited in the wild
3
check available
2
likely to be exploited
4

Every one of the 50 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. VMware vCenter Server - Arbitrary File UploadCVE-2021-22005VMware · CVSS 9.8 · 100% likely

    CWE-22

  2. VMware vSphere Client (HTML5) - Remote Code ExecutionCVE-2021-21972VMware · CVSS 9.8 · 100% likely

    CWE-22

  3. vCenter directory-traversal vulnerabilityCVE-2026-59310VMware · CVSS 9.8 · 62% likelycovered by CyberSIXT

    CWE-227 articles

  4. VMware vRealize Log Insight - Path TraversalCVE-2022-31706Vmware · CVSS 9.8 · 87% likely

    CWE-22

  5. Spring Framework - Path TraversalCVE-2025-41242VMware · CVSS 5.9 · 2.3% likely

    CWE-22

  6. Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows…CVE-2009-3733Vmware · 83% likely

    CWE-22

  7. The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory traversal. An authenticated SD-WAN Orc…CVE-2020-4000Vmware · 43% likely

    CWE-22

  8. Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can…CVE-2023-20890Vmware · CVSS 7.2 · 20% likely

    CWE-22

  9. Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VM…CVE-2016-5330Vmware · 19% likely

    CWE-426

  10. VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may a…CVE-2019-5526Vmware · 8.5% likely

    CWE-427

  11. Directory traversal vulnerability in the Connection Server in VMware Horizon View 5.x before 5.3.7, 6.x before 6.2.3, and 7.x before 7.0.1 allows remote attackers to obtain sensit…CVE-2016-7087Vmware · 4.4% likely

    CWE-22

  12. Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors.CVE-2013-3658Vmware · 3.7% likely

    CWE-22

  13. Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vectors.CVE-2016-5332Vmware · 3.0% likely

    CWE-22

  14. Multiple directory traversal vulnerabilities in the (1) View Connection Server and (2) View Security Server in VMware View 4.x before 4.6.2 and 5.x before 5.1.2 allow remote attac…CVE-2012-5978Vmware · 2.8% likely

    CWE-22

  15. Directory traversal vulnerability in VMware CapacityIQ 1.5.x allows remote attackers to read arbitrary files via unspecified vectors.CVE-2012-5051Vmware · 2.8% likely

    CWE-22

  16. Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack.…CVE-2015-5211Vmware · 2.6% likely

    CWE-552

  17. Directory traversal vulnerability in vCenter Server in VMware vCenter 4.0 before Update 3 and 4.1 before Update 1, and VMware VirtualCenter 2.5 before Update 6a, allows remote att…CVE-2011-0426Vmware · 2.1% likely

    CWE-22

  18. The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administ…CVE-2021-22015Vmware · 1.9% likely

    CWE-552

  19. The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance whic…CVE-2022-31703Vmware · CVSS 7.5 · 1.9% likely

    CWE-22

  20. Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe350-200810401-O-UG and ESX 3.5 before ESX350-200810201-UG allows administrators with the Datastore.FileManagement p…CVE-2008-4281Vmware · 1.9% likely

    CWE-22

  21. Directory traversal vulnerability in a support component in the web interface in VMware Studio 2.0 public beta before build 1017-185256 allows remote attackers to upload files to…CVE-2009-2968Vmware · 1.8% likely

    CWE-22

  22. The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 44…CVE-2021-22013Vmware · 1.7% likely

    CWE-22

  23. VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious acto…CVE-2022-22952Vmware · 1.5% likely

    CWE-434

  24. VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain…CVE-2021-21999Vmware · 1.5% likely

    CWE-427

  25. Directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1 allows remote authenticated users to read arbitrary files vi…CVE-2012-6324Vmware · 1.5% likely

    CWE-22

  26. VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue that exists due to some DLL files loaded by the application improperly. This issue may allow an at…CVE-2017-4939VMware · 1.3% likely

    CWE-426

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated