VMware Cloud Foundation 4.0

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.

Published: 2024-06-25T14:16:01.280Z
Updated: 2025-10-21T22:56:21.754Z

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.

Published: 2024-01-16T09:10:09.738Z
Updated: 2025-06-20T17:02:26.911Z

vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.

Published: 2023-10-25T04:21:42.267Z
Updated: 2025-10-21T23:05:33.739Z

The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.

Published: 2022-12-13T00:00:00.000Z
Updated: 2025-04-22T03:26:59.398Z

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.

Published: 2022-05-20T20:18:27.000Z
Updated: 2024-08-03T03:28:42.587Z