Threat database

VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

CVE-2026-59355 is an open redirect vulnerability in VMware Spring Authorization Server versions 1.5.0 through 1.5.7. The authorization endpoint does not sufficiently validate the request_uri parameter, allowing an attacker to craft a request with an invalid request_uri and an unvalidated redirect_uri. This can lead to redirection to attacker-controlled sites, potentially facilitating phishing or other malicious activities. The vulnerability has a CVSS score of 6.1, indicating medium severity.

CVE-2026-59354 is a critical vulnerability in Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4. When Dynamic Client Registration is enabled, the registration endpoint inadequately validates certain client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, potentially leading to Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF) depending on server configuration and metadata usage.

CVE-2026-41709 is a low-severity vulnerability in VMware Cloud Foundation involving insufficient logging. A malicious administrator could perform certain operations without those actions being recorded in logs. This issue affects multiple versions of VMware Cloud Foundation, including 5.x, 9.0.x.x, and 9.1.x.x. No official patch or remediation guidance has been published yet, and there are no known exploits in the wild.

CVE-2026-41703 is an out-of-bounds read vulnerability in VMware ESX, Workstation, and Fusion. A malicious actor with VM deployment privileges could exploit this to cause information disclosure or a denial-of-service (DoS) condition. The impact on Workstation and Fusion is limited to information disclosure, while on ESX it may lead to DoS of the host process. The vulnerability affects VMware Cloud Foundation versions 5.x, 9.0.x.x, and 9.1.x.x. No official patch or remediation guidance has been published yet.

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

VMware vCenter in Cloud Foundation contains a critical authentication bypass vulnerability in the VMware Directory Service. This flaw allows an attacker with network access to bypass authentication and gain unauthorized access to the system. The vulnerability affects multiple versions of Cloud Foundation, including 5.x, 9.0.x.x, and 9.1.x.x. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.

VMware Cloud Foundation (VCF) Operations version 5.x contains multiple stored cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow a malicious user with privileges to create policies, views, or text widgets to inject scripts that could perform administrative actions within the VCF Operations environment. The issue is classified under CWE-79 and has a high severity rating with a CVSS score of 8. No official patch or remediation guidance has been provided yet.

VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities. An attacker with privileges to create policies, views, or text widgets could inject malicious scripts that execute administrative actions within the system. This vulnerability affects certain 5.x, 9.0.x.x, and 9.1.x.x versions of the product. The CVSS score is 8.0, indicating a high severity. No official patch or remediation guidance is currently provided by the vendor.