VMware vulnerabilities (CVEs)

100 CVEs matched to VMware by name in NVD, none on CISA's Known Exploited list.

Back to the VMware profile · Alternatives to VMware · CVE RSS feed

Exploitation riskProbably exploited

100 of 100 CVEs assessed

confirmed exploited

EPSS ≥ 10%

>99%

highest single CVE

1 CVE has an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2008-3892 ↗EPSS 24%LEV ≥>99%Probably exploited
Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 1…
CVE-2007-5360 ↗EPSS 15%LEV ≥>99%Probably exploited
Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS_USE_PAM_STANDALONE_PROC defined, as used in VMWare ESX Server 3.0.1 …
CVE-2007-0063 ↗EPSS 20%LEV ≥>99%Probably exploited
Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Pl…

Recent changes

last 90 days

CVE-2006-5990 is now estimated at a 88% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2007-4496 is now estimated at a 79% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2005-4773 is now estimated at a 52% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2006-2662 is now estimated at a 57% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2007-1744 is now estimated at a 65% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	High	Medium	Low	Total
2009	6	10	1	17
2008	18	11	2	31
2007	14	10	4	28
2006	0	5	1	6
2005	3	5	1	9
2004	1	0	0	1
2003	2	1	1	4
2002	1	0	0	1
2001	0	0	1	1
2000	0	0	1	1
1999	1	0	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2008-3892	24%	98%
CVE-2007-4058	22%	98%
CVE-2007-0063	20%	97%
CVE-2007-5360	15%	97%
CVE-2005-4459	14%	97%
CVE-2002-0814	14%	96%
CVE-2009-3707	11%	96%
CVE-2007-4155	9.6%	95%
CVE-2009-0177	8.6%	95%
CVE-2007-0062	7.6%	95%

Known CVEs (100)

RSS ⇢

CVE-2009-3707 ↗EPSS 11%MEDIUM 5.02009
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 befo…
CVE-2009-3282 ↗HIGH 7.82009
Integer overflow in the vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 allows host OS users to cause a denial of service to the host OS via unspecified vectors.

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to VMware by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-17.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.