VMware vCenter Server known exploited vulnerabilities, ranked
CISA lists 9 VMware vCenter Server CVEs as exploited in the wild. 0 were added in the last 12 months and 3 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2021-21985: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2021-22005: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2021-21972: EPSS 99.87%, used in ransomware, added 2021-11-03
- CVE-2023-34048: EPSS 99.43%, added 2024-01-22
- CVE-2020-3952: EPSS 90.4%, added 2021-11-03
All 9 VMware vCenter Server CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2021-21985 | vCenter Server Improper Input Validation | 100.00% | Yes | 2021-11-03 | 2021-11-17 |
| 2 | CVE-2021-22005 | vCenter Server File Upload | 100.00% | Yes | 2021-11-03 | 2021-11-17 |
| 3 | CVE-2021-21972 | vCenter Server Remote Code Execution | 99.87% | Yes | 2021-11-03 | 2021-11-17 |
| 4 | CVE-2023-34048 | vCenter Server Out-of-Bounds Write | 99.43% | – | 2024-01-22 | 2024-02-12 |
| 5 | CVE-2020-3952 | vCenter Server Information Disclosure | 90.4% | – | 2021-11-03 | 2022-05-03 |
| 6 | CVE-2024-38812 | vCenter Server Heap-Based Buffer Overflow | 54.6% | – | 2024-11-20 | 2024-12-11 |
| 7 | CVE-2021-22017 | vCenter Server Improper Access Control | 49.2% | – | 2022-01-10 | 2022-01-24 |
| 8 | CVE-2024-38813 | vCenter Server Privilege Escalation | 17.4% | – | 2024-11-20 | 2024-12-11 |
| 9 | CVE-2022-22948 | vCenter Server Incorrect Default File Permissions | 13.3% | – | 2024-07-17 | 2024-08-07 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all VMware KEV CVEs · free KEV badge for VMware · all vendors