41
CVEs
12
Critical
16
High
1
KEV
1
PoC
22
Unpatched C/H
22.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
16
MEDIUM
11
LOW
2
Monthly CVE Trend
Affected Products (30)
Java
165
Cloud Foundation
126
Workstation
120
Fusion
104
ESXi
103
Vcenter Server
73
Spring Framework
56
Debian Linux
32
Spring Security
30
Identity Manager
28
Esx
28
Player
27
Workstation Pro
26
Workstation Player
25
Horizon Client
24
Vrealize Suite Lifecycle Manager
21
Tools
20
Vrealize Automation
19
Vrealize Operations
18
Telco Cloud Platform
16
Workspace One Access
15
Spring Boot
15
Identity Manager Connector
14
Fedora
14
Vcenter Server Appliance
14
Open Redirect
13
Aria Operations
13
Insurance Rules Palette
13
Horizon View
13
Healthcare Master Person Index
12
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-59310 | Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch. | CRITICAL | 9.8 | 1.1% | 125 |
KEV
PoC
|
| CVE-2026-59309 | Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical. | CRITICAL | 9.8 | 0.7% | 55 |
|
| CVE-2026-47876 | Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact. | CRITICAL | 9.3 | 0.3% | 52 |
No patch
|
| CVE-2026-67261 | Remote code execution in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker inject OS commands through the IAPI component and run them as root on the appliance's host OS. Because the flaw requires no authentication and no user interaction over the network, it enables full compromise of the VSI deployment and the storage infrastructure it manages. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated root RCE make this a top-priority patch. | CRITICAL | 9.8 | 1.6% | 51 |
|
| CVE-2026-47865 | Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch. | CRITICAL | 9.8 | 0.7% | 50 |
No patch
|
| CVE-2026-54489 | Sensitive information disclosure in Dell Virtual Storage Integrator (VSI) for VMware vSphere Client, all versions prior to 10.11.1.0, lets an unauthenticated remote attacker retrieve active session credentials and hijack authenticated sessions, including those of administrators. Because stolen session tokens grant full impersonation of legitimate users, Dell rates this critical (CVSS 9.8); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the SSVC framework flags it as automatable with total technical impact. EPSS remains low at 0.39% (32nd percentile), consistent with the absence of observed exploitation to date. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-47892 | Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows an attacker to defeat header-based route predicates by sending a CORS pre-flight (OPTIONS) request, reaching routes that should have been gated by header conditions. It affects Spring Framework 5.2.5-5.2.25, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8 in the specific WebFlux-functional-plus-DispatcherServlet deployment mode. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 9th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-47884 | Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-47890 | Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-47891 | Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8) occurs when the Aalto XML processor is used to parse request bodies, because the maxInMemorySize buffering limit is not correctly enforced. Remote attackers can submit oversized XML to trigger unbounded in-memory buffering and exhaust heap memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC lists exploitation status as none, though it rates the flaw automatable with total technical impact. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-59270 | Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile). | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-47871 | Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.8 | 0.9% | 45 |
No patch
|
| CVE-2026-47867 | Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-47869 | Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-47870 | Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis. | HIGH | 8.8 | 0.4% | 44 |
No patch
|