Refine your search
239 vulnerabilities found for by VMware
CVE-2026-59355 (GCVE-0-2026-59355)
Vulnerability from cvelistv5
Published
2026-08-27 06:35
Modified
2026-08-27 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Summary
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Spring Authorization Server |
Version: 1.5.0 ≤ 1.5.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:37:03.989783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:37:30.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2/org/springframework/security/spring-security-oauth2-authorization-server/",
"defaultStatus": "unaffected",
"packageName": "org.springframework.security:spring-security-oauth2-authorization-server",
"product": "Spring Authorization Server",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "1.5.7",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.5.8",
"versionType": "OSS"
},
{
"status": "unaffected",
"version": "1.5.7.1",
"versionType": "enterprise support only"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jon Kjennbakken (Vipps MobilePay)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.\u003c/p\u003e"
}
],
"value": "In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T06:35:09.607Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"name": "spring.io",
"tags": [
"vendor-advisory"
],
"url": "https://spring.io/security/cve-2026-59355"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading.\u003c/p\u003e"
}
],
"value": "Upgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-09T00:00:00.000Z",
"value": "Public disclosure and fix released (Spring Authorization Server 1.5.8 / 1.5.7.1)."
}
],
"title": "Spring Authorization Server: Open Redirect via request_uri parameter"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59355",
"datePublished": "2026-08-27T06:35:09.607Z",
"dateReserved": "2026-07-04T18:14:46.172Z",
"dateUpdated": "2026-08-27T13:37:30.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41709 (GCVE-0-2026-41709)
Vulnerability from cvelistv5
Published
2026-07-30 12:45
Modified
2026-07-30 15:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-778 - Insufficient logging
Summary
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | Cloud Foundation |
Version: 9.1.x.x Version: 9.0.x.x Version: 5.x < 5.2.4 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41709",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T15:10:06.249329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:10:15.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
},
{
"lessThan": "5.2.4",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vSphere Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESX",
"vendor": "VMware",
"versions": [
{
"lessThan": "ESXi-9.1.0.0-25370933",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThan": "ESXi-9.0.2.0100-25595025",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThan": "ESXi80U3j-25429389",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "5.1.x"
},
{
"status": "affected",
"version": "5.0.x"
}
]
}
],
"datePublic": "2026-07-29T04:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware ESX contains an insufficient logging vulnerability.\u0026nbsp;\u003cspan\u003eA malicious administrator could exploit this issue to perform certain operations without them being logged.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "VMware ESX contains an insufficient logging vulnerability.\u00a0A malicious administrator could exploit this issue to perform certain operations without them being logged."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-778",
"description": "CWE-778 Insufficient logging",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:45:02.292Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ESX insufficient logging vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41709",
"datePublished": "2026-07-30T12:45:02.292Z",
"dateReserved": "2026-04-22T06:21:34.490Z",
"dateUpdated": "2026-07-30T15:10:15.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41703 (GCVE-0-2026-41703)
Vulnerability from cvelistv5
Published
2026-07-30 12:39
Modified
2026-07-30 15:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds read
Summary
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | Cloud Foundation |
Version: 9.1.x.x Version: 9.0.x.x Version: 5.x < 5.2.3 |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T15:08:36.980484Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:09:25.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
},
{
"lessThan": "5.2.3",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vSphere Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESX",
"vendor": "VMware",
"versions": [
{
"lessThan": "ESXi-9.1.0.0-25370933",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThan": "ESXi-9.0.2.0100-25595025",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThan": "ESXi80U3i-25205845",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Workstation",
"vendor": "VMware",
"versions": [
{
"lessThan": "26H1",
"status": "affected",
"version": "25H2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Fusion",
"vendor": "VMware",
"versions": [
{
"lessThan": "26H1",
"status": "affected",
"version": "25H2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "5.1.x"
},
{
"status": "affected",
"version": "5.0.x"
}
]
}
],
"datePublic": "2026-07-29T04:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware ESX,\u0026nbsp;Workstation, and Fusion\u0026nbsp;contain an out-of-bounds read vulnerability. A malicious actor with\u0026nbsp;VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process.\u0026nbsp;On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure."
}
],
"value": "VMware ESX,\u00a0Workstation, and Fusion\u00a0contain an out-of-bounds read vulnerability. A malicious actor with\u00a0VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process.\u00a0On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:39:02.552Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds read vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41703",
"datePublished": "2026-07-30T12:39:02.552Z",
"dateReserved": "2026-04-22T06:21:22.982Z",
"dateUpdated": "2026-07-30T15:09:25.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47876 (GCVE-0-2026-47876)
Vulnerability from cvelistv5
Published
2026-07-30 12:31
Modified
2026-07-30 13:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds write
Summary
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | Cloud Foundation |
Version: 9.1.x.x Version: 9.0.x.x Version: 5.x |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47876",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T13:02:22.733448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T13:02:29.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
},
{
"status": "affected",
"version": "5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vSphere Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ESX",
"vendor": "VMware",
"versions": [
{
"lessThan": "ESXi-9.1.0.0200-25557999",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThan": "ESXi-9.0.2.0100-25595025",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThan": "ESXi80U3k-25595708",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "5.1.x"
},
{
"status": "affected",
"version": "5.0.x"
}
]
}
],
"datePublic": "2026-07-29T04:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter.\u0026nbsp;\u003cspan\u003eA malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter.\u00a0A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:31:52.158Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMXNET3 out-of-bounds write vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47876",
"datePublished": "2026-07-30T12:31:52.158Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-07-30T13:02:29.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59309 (GCVE-0-2026-59309)
Vulnerability from cvelistv5
Published
2026-07-30 12:19
Modified
2026-07-30 15:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-303 - Incorrect implementation of authentication algorithm
Summary
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | Cloud Foundation |
Version: 9.1.x.x Version: 9.0.x.x Version: 5.x |
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59309",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-30T15:07:53.144480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T15:08:05.176Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
},
{
"status": "affected",
"version": "5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vSphere Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vCenter",
"vendor": "VMware",
"versions": [
{
"lessThan": "9.1.0.0300",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThan": "9.0.2.0100",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThan": "8.0 U3k",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Infrastructure",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "5.1.x"
},
{
"status": "affected",
"version": "5.0.x"
},
{
"status": "affected",
"version": "4.x"
},
{
"status": "affected",
"version": "3.0"
}
]
}
],
"datePublic": "2026-07-29T04:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.\u0026nbsp;\u003cspan\u003eA malicious actor with network access to vCenter\u0026nbsp;may exploit this issue to bypass authentication and gain unauthorized access to the system.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.\u00a0A malicious actor with network access to vCenter\u00a0may exploit this issue to bypass authentication and gain unauthorized access to the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303 Incorrect implementation of authentication algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:27:12.963Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "vCenter authentication-bypass vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59309",
"datePublished": "2026-07-30T12:19:52.390Z",
"dateReserved": "2026-07-04T18:13:57.026Z",
"dateUpdated": "2026-07-30T15:08:05.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59310 (GCVE-0-2026-59310)
Vulnerability from cvelistv5
Published
2026-07-30 12:19
Modified
2026-08-19 03:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | Cloud Foundation |
Version: 9.1.x.x Version: 9.0.x.x Version: 5.x |
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59310",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-18",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T03:55:49.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "CVE-2026-59310 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
},
{
"status": "affected",
"version": "5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vSphere Foundation",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "9.1.x.x"
},
{
"status": "affected",
"version": "9.0.x.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "vCenter",
"vendor": "VMware",
"versions": [
{
"lessThan": "9.1.0.0300",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThan": "9.0.2.0100",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThan": "8.0 U3k",
"status": "affected",
"version": "8.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Infrastructure",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "5.1.x"
},
{
"status": "affected",
"version": "5.0.x"
},
{
"status": "affected",
"version": "4.x"
},
{
"status": "affected",
"version": "3.0"
}
]
}
],
"datePublic": "2026-07-29T04:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware vCenter contains a directory traversal vulnerability in the Syslog server.\u0026nbsp;\u003cspan\u003eA malicious actor with network access to vCenter\u0026nbsp;may exploit this issue to execute arbitrary code.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "VMware vCenter contains a directory traversal vulnerability in the Syslog server.\u00a0A malicious actor with network access to vCenter\u00a0may exploit this issue to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:28:20.696Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "vCenter directory-traversal vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59310",
"datePublished": "2026-07-30T12:19:25.296Z",
"dateReserved": "2026-07-04T18:13:57.026Z",
"dateUpdated": "2026-08-19T03:55:49.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47871 (GCVE-0-2026-47871)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-23 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 32.1.1 < Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T03:56:20.090Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "32.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e32.1.1 (fixed in 32.1.2)\u003c/li\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:21.563Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Directory Traversal Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47871",
"datePublished": "2026-07-18T08:57:21.563Z",
"dateReserved": "2026-05-20T10:00:57.077Z",
"dateUpdated": "2026-07-23T03:56:20.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47870 (GCVE-0-2026-47870)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-24 20:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 32.1.1 < Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47870",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T03:56:19.785951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T20:17:47.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "32.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e32.1.1 (fixed in 32.1.2)\u003c/li\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious authenticated user with network access may be able to execute remote code."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:18.882Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47870",
"datePublished": "2026-07-18T08:57:18.882Z",
"dateReserved": "2026-05-20T10:00:57.077Z",
"dateUpdated": "2026-07-24T20:17:47.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47869 (GCVE-0-2026-47869)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-23 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 32.1.1 < Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T03:56:18.600Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "32.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e32.1.1 (fixed in 32.1.2)\u003c/li\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious authenticated user with network access may be able to inject and execute code."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:16.678Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47869",
"datePublished": "2026-07-18T08:57:16.678Z",
"dateReserved": "2026-05-20T10:00:57.077Z",
"dateUpdated": "2026-07-23T03:56:18.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47868 (GCVE-0-2026-47868)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-23 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 32.1.1 < Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T03:56:17.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "32.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e32.1.1 (fixed in 32.1.2)\u003c/li\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious user with local access may be able to escalate their privileges to run code as root."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:14.131Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47868",
"datePublished": "2026-07-18T08:57:14.131Z",
"dateReserved": "2026-05-20T10:00:57.077Z",
"dateUpdated": "2026-07-23T03:56:17.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47867 (GCVE-0-2026-47867)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-23 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 32.1.1 < Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T03:56:17.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "32.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e32.1.1 (fixed in 32.1.2)\u003c/li\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious user with network access may be able to access the Avi Control plane and execute code remotely."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:11.729Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47867",
"datePublished": "2026-07-18T08:57:11.729Z",
"dateReserved": "2026-05-20T10:00:57.077Z",
"dateUpdated": "2026-07-23T03:56:17.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47866 (GCVE-0-2026-47866)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-23 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.
Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 32.1.1 < Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47866",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T03:56:16.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"status": "affected",
"version": "32.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e32.1.1 (fixed in 32.1.2)\u003c/li\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.\n\nAffected versions:\n32.1.1 (fixed in 32.1.2)\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:08.170Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Authorization Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47866",
"datePublished": "2026-07-18T08:57:08.170Z",
"dateReserved": "2026-05-20T10:00:57.077Z",
"dateUpdated": "2026-07-23T03:56:16.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47865 (GCVE-0-2026-47865)
Vulnerability from cvelistv5
Published
2026-07-18 08:57
Modified
2026-07-23 03:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.
Affected versions:
31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
30.1.1 through 30.2.6 (fixed in 30.2.7)
22.1.1 through 22.1.7 (fixed in 30.2.7)
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Avi Load Balancer |
Version: 31.1.1 < Version: 30.1.1 < Version: 22.1.1 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T03:56:15.727Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Avi Load Balancer",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "31.2.2",
"status": "affected",
"version": "31.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "30.2.6",
"status": "affected",
"version": "30.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.7",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.\u003c/p\u003e\u003cp\u003eAffected versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\u003c/li\u003e\u003cli\u003e30.1.1 through 30.2.6 (fixed in 30.2.7)\u003c/li\u003e\u003cli\u003e22.1.1 through 22.1.7 (fixed in 30.2.7)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.\n\nAffected versions:\n31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)\n30.1.1 through 30.2.6 (fixed in 30.2.7)\n22.1.1 through 22.1.7 (fixed in 30.2.7)"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:57:05.890Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Avi Load Balancer Authentication Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47865",
"datePublished": "2026-07-18T08:57:05.890Z",
"dateReserved": "2026-05-20T10:00:57.076Z",
"dateUpdated": "2026-07-23T03:56:15.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59269 (GCVE-0-2026-59269)
Vulnerability from cvelistv5
Published
2026-07-09 07:12
Modified
2026-07-09 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.
Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T12:45:32.426360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T12:45:41.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pinniped",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "0.46.0",
"status": "affected",
"version": "0.11.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server\u0027s database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.\u003cbr\u003eAffected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0."
}
],
"value": "A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server\u0027s database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group.\nAffected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Potential privilege escalation in Kubernetes clusters via Active Directory LDAP group DN confusion, under narrow, specific configuration conditions."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T07:12:10.791Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://github.com/vmware/pinniped/security/advisories/GHSA-7xq8-m6h6-2xg8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59269",
"datePublished": "2026-07-09T07:12:10.791Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-07-09T12:45:41.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41724 (GCVE-0-2026-41724)
Vulnerability from cvelistv5
Published
2026-06-08 07:07
Modified
2026-06-09 11:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | VCF operations |
Version: 5.x < |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41724",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T03:55:33.666743Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T11:51:48.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "VCF operations",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "VMware Aria Operations",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "8.18.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "VMware Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-06-08T06:57:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.\u003cdiv\u003eA malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.\u003c/div\u003e"
}
],
"value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T07:07:04.191Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41724",
"datePublished": "2026-06-08T07:07:04.191Z",
"dateReserved": "2026-04-22T06:21:39.014Z",
"dateUpdated": "2026-06-09T11:51:48.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41723 (GCVE-0-2026-41723)
Vulnerability from cvelistv5
Published
2026-06-08 07:06
Modified
2026-06-09 11:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | VCF operations |
Version: 9.1.x.x < Version: 9.0.x.x < Version: 5.x < |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T03:55:31.354854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T11:52:17.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "VCF operations",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "9.1.0.0",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.2.0 EP2",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "VMware Aria Operations",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.6",
"status": "affected",
"version": "8.18.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "8.18.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "VMware Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-06-08T06:57:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.\u003cdiv\u003eA malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.\u003c/div\u003e"
}
],
"value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T07:06:11.548Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41723",
"datePublished": "2026-06-08T07:06:11.548Z",
"dateReserved": "2026-04-22T06:21:37.021Z",
"dateUpdated": "2026-06-09T11:52:17.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41722 (GCVE-0-2026-41722)
Vulnerability from cvelistv5
Published
2026-06-08 07:05
Modified
2026-06-09 11:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VMware | VCF operations |
Version: 9.1.x.x < Version: 9.0.x.x < Version: 5.x < |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T03:55:32.470083Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T11:52:36.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "VCF operations",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "9.1.0.0",
"status": "affected",
"version": "9.1.x.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "9.0.2.0 EP2",
"status": "affected",
"version": "9.0.x.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "VMware Aria Operations",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.6",
"status": "affected",
"version": "8.18.x",
"versionType": "custom"
},
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "8.18.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "VMware Telco Cloud Platform",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "8.18.7",
"status": "affected",
"version": "5.x",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-06-08T06:57:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.\u003cdiv\u003eA malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.\u003c/div\u003e"
}
],
"value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T07:05:31.333Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41722",
"datePublished": "2026-06-08T07:05:31.333Z",
"dateReserved": "2026-04-22T06:21:37.021Z",
"dateUpdated": "2026-06-09T11:52:36.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41702 (GCVE-0-2026-41702)
Vulnerability from cvelistv5
Published
2026-05-15 06:11
Modified
2026-05-15 09:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Summary
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41702",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T09:52:45.494500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T09:52:56.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS"
],
"product": "Fusion",
"vendor": "VMware",
"versions": [
{
"lessThan": "2026H1",
"status": "affected",
"version": "2025H2",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-05-14T06:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability\u0026nbsp;that occurs during an operation performed by a SETUID binary.\u0026nbsp;\u003cspan\u003eA malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability\u00a0that occurs during an operation performed by a SETUID binary.\u00a0A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T06:11:38.418Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "TOCTOU local privilege escalation vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41702",
"datePublished": "2026-05-15T06:11:38.418Z",
"dateReserved": "2026-04-22T06:21:22.982Z",
"dateUpdated": "2026-05-15T09:52:56.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41713 (GCVE-0-2026-41713)
Vulnerability from cvelistv5
Published
2026-05-12 10:17
Modified
2026-05-12 12:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Summary
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T12:11:07.556751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T12:11:27.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AI",
"vendor": "VMware",
"versions": [
{
"lessThan": "1.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "oss"
},
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.0",
"versionType": "oss"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ahmed Sekka (GitHub: https://github.com/ahmed-sekka )"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.\u003c/p\u003e"
}
],
"value": "A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T10:19:26.231Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-41713"
},
{
"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N\u0026version=3.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41713",
"datePublished": "2026-05-12T10:17:39.094Z",
"dateReserved": "2026-04-22T06:21:34.490Z",
"dateUpdated": "2026-05-12T12:11:27.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41712 (GCVE-0-2026-41712)
Vulnerability from cvelistv5
Published
2026-05-12 10:17
Modified
2026-05-12 12:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T12:13:06.957308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T12:14:22.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AI",
"vendor": "VMware",
"versions": [
{
"lessThan": "1.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
},
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ahmed Sekka (GitHub: https://github.com/ahmed-sekka ); sharlongwen"
}
],
"descriptions": [
{
"lang": "en",
"value": "Spring AI\u0027s chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T10:17:36.399Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-41712"
},
{
"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\u0026version=3.1"
}
],
"title": "ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41712",
"datePublished": "2026-05-12T10:17:36.399Z",
"dateReserved": "2026-04-22T06:21:34.490Z",
"dateUpdated": "2026-05-12T12:14:22.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22745 (GCVE-0-2026-22745)
Vulnerability from cvelistv5
Published
2026-04-29 11:35
Modified
2026-04-29 13:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.
More precisely, an application can be vulnerable when all the following are true:
* the application is using Spring MVC or Spring WebFlux
* the application is serving static resources from the file system
* the application is running on a Windows platform
When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Spring Framework |
Version: 7.0.0 Version: 6.2.0 Version: 6.1.0 Version: 5.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T13:23:48.299313Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T13:23:54.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Spring Framework",
"vendor": "VMware",
"versions": [
{
"lessThan": "7.0.7",
"status": "affected",
"version": "7.0.0",
"versionType": "OSS"
},
{
"lessThan": "6.2.18",
"status": "affected",
"version": "6.2.0",
"versionType": "OSS"
},
{
"lessThan": "6.1.27",
"status": "affected",
"version": "6.1.0",
"versionType": "COMMERCIAL"
},
{
"lessThan": "5.3.48",
"status": "affected",
"version": "5.3.0",
"versionType": "COMMERCIAL"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bocheng Xiang ( @crispr ) from Fudan University."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSpring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eMore precisely, an application can be vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application is using Spring MVC or Spring WebFlux\u003c/li\u003e\u003cli\u003ethe application is serving static resources from the file system\u003c/li\u003e\u003cli\u003ethe application is running on a Windows platform\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.\u003c/p\u003e"
}
],
"value": "Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is serving static resources from the file system\n * the application is running on a Windows platform\n\n\nWhen all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T11:38:09.237Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22745"
},
{
"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\u0026version=3.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-22745 : Denial of service in static resource handling on Windows platforms",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22745",
"datePublished": "2026-04-29T11:35:21.947Z",
"dateReserved": "2026-01-09T06:55:03.990Z",
"dateUpdated": "2026-04-29T13:23:54.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22741 (GCVE-0-2026-22741)
Vulnerability from cvelistv5
Published
2026-04-29 11:32
Modified
2026-04-29 14:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-524 - Information Exposure Through Caching
Summary
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
More precisely, an application can be vulnerable when all the following are true:
* the application is using Spring MVC or Spring WebFlux
* the application is configuring the resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with caching enabled
* the application adds support for encoded resources resolution
* the resource cache must be empty when the attacker has access to the application
When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Spring Framework |
Version: 7.0.0 Version: 6.2.0 Version: 6.1.0 Version: 5.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22741",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T13:19:19.166572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T13:19:38.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Spring Framework",
"vendor": "VMware",
"versions": [
{
"lessThan": "7.0.7",
"status": "affected",
"version": "7.0.0",
"versionType": "oss"
},
{
"lessThan": "6.2.18",
"status": "affected",
"version": "6.2.0",
"versionType": "oss"
},
{
"lessThan": "6.1.27",
"status": "affected",
"version": "6.1.0",
"versionType": "commercial"
},
{
"lessThan": "5.3.48",
"status": "affected",
"version": "5.3.0",
"versionType": "commercial"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuki Matsuhashi ."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSpring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eMore precisely, an application can be vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application is using Spring MVC or Spring WebFlux\u003c/li\u003e\u003cli\u003ethe application is configuring the\u0026nbsp;\u003ca href=\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\"\u003eresource chain support\u003c/a\u003e\u0026nbsp;with caching enabled\u003c/li\u003e\u003cli\u003ethe application adds support for encoded resources resolution\u003c/li\u003e\u003cli\u003ethe resource cache must be empty when the attacker has access to the application\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.\u003c/p\u003e"
}
],
"value": "Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is configuring the\u00a0 resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with caching enabled\n * the application adds support for encoded resources resolution\n * the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Information Exposure Through Caching",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T14:01:42.273Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22741"
},
{
"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L\u0026version=3.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Static resource cache poisoning in Spring MVC and WebFlux",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22741",
"datePublished": "2026-04-29T11:32:12.548Z",
"dateReserved": "2026-01-09T06:54:49.675Z",
"dateUpdated": "2026-04-29T14:01:42.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22740 (GCVE-0-2026-22740)
Vulnerability from cvelistv5
Published
2026-04-29 10:46
Modified
2026-04-29 14:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Spring Framework |
Version: 7.0.0 ≤ Version: 6.2.0 ≤ Version: 6.1.0 ≤ Version: 5.3.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22740",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T11:55:51.268118Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T11:58:39.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Spring Framework",
"vendor": "VMware",
"versions": [
{
"lessThan": "7.0.7",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThan": "6.2.18",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThan": "6.1.27",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThan": "5.3.48",
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.\u003c/p\u003e\u003cp\u003eOlder, unsupported versions are also affected.\u003c/p\u003e"
}
],
"value": "A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.\n\nOlder, unsupported versions are also affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-29T14:00:50.573Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22740"
},
{
"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\u0026version=3.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring Framework DoS with Multipart Temp Files in WebFlux",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22740",
"datePublished": "2026-04-29T10:46:15.633Z",
"dateReserved": "2026-01-09T06:54:49.675Z",
"dateUpdated": "2026-04-29T14:00:50.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40966 (GCVE-0-2026-40966)
Vulnerability from cvelistv5
Published
2026-04-28 06:42
Modified
2026-04-28 13:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-284 - Improper Access Control
Summary
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40966",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-28T13:18:57.595874Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T13:37:35.770Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AI",
"vendor": "VMware",
"versions": [
{
"lessThan": "1.0.6",
"status": "affected",
"version": "1.0.0",
"versionType": "OSS"
},
{
"lessThan": "1.1.5",
"status": "affected",
"version": "1.1.0",
"versionType": "oss"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jinyeong Seol Seol-JY; Cantina\u0027s AppSec agent, Apex ( https://www.cantina.security )"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users\u2019 chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.\u003c/p\u003e"
}
],
"value": "In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users\u2019 chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T06:49:32.025Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-40966"
},
{
"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1\u0026vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-40966",
"datePublished": "2026-04-28T06:42:36.619Z",
"dateReserved": "2026-04-16T02:18:56.133Z",
"dateUpdated": "2026-04-28T13:37:35.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22750 (GCVE-0-2026-22750)
Vulnerability from cvelistv5
Published
2026-04-10 07:32
Modified
2026-04-10 12:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.
Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Spring Cloud Gateway |
Version: 4.2.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22750",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T12:59:10.606788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "CWE-15 External Control of System or Configuration Setting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T12:59:14.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Spring Cloud Gateway",
"product": "Spring Cloud Gateway",
"vendor": "VMware",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4.2.0",
"versionType": "ENTERPRISE"
}
]
}
],
"datePublic": "2026-04-09T14:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u0026nbsp;\u003ccode\u003espring.ssl.bundle\u003c/code\u003e, the configuration was silently ignored and the default SSL configuration was used instead.\u003cbr\u003eNote: The\u0026nbsp;\u003ccode\u003e4.2.x\u003c/code\u003e\u0026nbsp;branch is no longer under open source support. If you are using Spring Cloud Gateway\u0026nbsp;\u003ccode\u003e4.2.0\u003c/code\u003e\u0026nbsp;and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u0026nbsp;\u003ccode\u003e4.2.x\u003c/code\u003e\u0026nbsp;release newer than\u0026nbsp;\u003ccode\u003e4.2.0\u003c/code\u003e\u0026nbsp;\u003ca href=\"https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/\"\u003eavailable on Maven Centeral\u003c/a\u003e. Ideally if you are not an enterprise customer, you should be upgrading to\u0026nbsp;\u003ccode\u003e5.0.2\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003e5.1.1\u003c/code\u003e\u0026nbsp;which are the current supported open source releases."
}
],
"value": "When configuring SSL bundles in Spring Cloud Gateway by using the configuration property\u00a0spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.\nNote: The\u00a04.2.x\u00a0branch is no longer under open source support. If you are using Spring Cloud Gateway\u00a04.2.0\u00a0and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway\u00a04.2.x\u00a0release newer than\u00a04.2.0\u00a0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to\u00a05.0.2\u00a0or\u00a05.1.1\u00a0which are the current supported open source releases."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T07:32:31.260Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22750"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SSL bundle configuration silently bypassed in Spring Cloud Gateway",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22750",
"datePublished": "2026-04-10T07:32:31.260Z",
"dateReserved": "2026-01-09T06:55:03.990Z",
"dateUpdated": "2026-04-10T12:59:14.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22732 (GCVE-0-2026-22732)
Vulnerability from cvelistv5
Published
2026-03-19 22:47
Modified
2026-04-02 07:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.
This issue affects Spring Security Servlet applications using lazy (default) writing of HTTP Headers:
: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Spring Security |
Version: 5.7.0 < Version: 5.8.0 < Version: 6.3.0 < Version: 6.4.0 < Version: 6.5.0 < Version: 7.0.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-21T04:01:50.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Spring Security",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "5.7.21",
"status": "affected",
"version": "5.7.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.8.23",
"status": "affected",
"version": "5.8.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.3.14",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.4.14",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.5.8",
"status": "affected",
"version": "6.5.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.0.3",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.\u0026nbsp;\u003cbr\u003e\u003cp\u003eThis issue affects \u003cspan\u003eSpring Security\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cb\u003eServlet applications using lazy (default) writing of HTTP Headers:\u003c/b\u003e\u003c/p\u003e\u003cp\u003e: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.\u003c/p\u003e"
}
],
"value": "When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.\u00a0\nThis issue affects Spring Security\u00a0Servlet applications using lazy (default) writing of HTTP Headers:\n\n: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T07:20:58.779Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22732"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Under Some Conditions Spring Security HTTP Headers Are not Written",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22732",
"datePublished": "2026-03-19T22:47:38.199Z",
"dateReserved": "2026-01-09T06:54:41.498Z",
"dateUpdated": "2026-04-02T07:20:58.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22729 (GCVE-0-2026-22729)
Vulnerability from cvelistv5
Published
2026-03-18 07:39
Modified
2026-03-18 15:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.
This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.
The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22729",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-18T14:50:07.381087Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-917",
"description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T15:35:10.685Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Spring AI",
"product": "Spring AI",
"vendor": "VMware",
"versions": [
{
"lessThan": "1.0.4",
"status": "affected",
"version": "1.0.x",
"versionType": "OSS"
},
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.x",
"versionType": "oss"
}
]
}
],
"datePublic": "2026-03-17T07:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA JSONPath injection vulnerability in Spring AI\u0027s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\u003c/p\u003e\u003cp\u003eThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\u003c/p\u003e\u003cp\u003eThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like\u0026nbsp;\u003ccode\u003e\"\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e||\u003c/code\u003e, and\u0026nbsp;\u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e\u0026nbsp;are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.\u003c/p\u003e"
}
],
"value": "A JSONPath injection vulnerability in Spring AI\u0027s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\n\nThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\n\nThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like\u00a0\",\u00a0||, and\u00a0\u0026\u0026\u00a0are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T07:39:56.739Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22729"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22729",
"datePublished": "2026-03-18T07:39:56.739Z",
"dateReserved": "2026-01-09T06:54:41.497Z",
"dateUpdated": "2026-03-18T15:35:10.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22730 (GCVE-0-2026-22730)
Vulnerability from cvelistv5
Published
2026-03-18 07:36
Modified
2026-03-19 03:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.
The vulnerability exists due to missing input sanitization.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22730",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-18T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-19T03:55:21.545Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Spring AI",
"product": "Spring AI",
"vendor": "VMware",
"versions": [
{
"lessThan": "1.0.4",
"status": "affected",
"version": "1.0.x",
"versionType": "OSS"
},
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.x",
"versionType": "oss"
}
]
}
],
"datePublic": "2026-03-17T07:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA critical SQL injection vulnerability in Spring AI\u0027s MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.\u003c/p\u003e\u003cp\u003eThe vulnerability exists due to missing input sanitization.\u003c/p\u003e"
}
],
"value": "A critical SQL injection vulnerability in Spring AI\u0027s MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.\n\nThe vulnerability exists due to missing input sanitization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T07:36:30.533Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-22730"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22730",
"datePublished": "2026-03-18T07:36:30.533Z",
"dateReserved": "2026-01-09T06:54:41.498Z",
"dateUpdated": "2026-03-19T03:55:21.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22717 (GCVE-0-2026-22717)
Vulnerability from cvelistv5
Published
2026-02-27 19:11
Modified
2026-02-27 20:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Workstation |
Version: 25H2 < 25H1U1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-27T20:14:05.072360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T20:14:10.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Workstation",
"vendor": "VMware",
"versions": [
{
"lessThan": "25H1U1",
"status": "affected",
"version": "25H2",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed.\u003cbr\u003e"
}
],
"value": "Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T19:11:54.924Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36986"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Workstation out-of-bound read vulnerability",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22717",
"datePublished": "2026-02-27T19:11:54.924Z",
"dateReserved": "2026-01-09T06:54:36.841Z",
"dateUpdated": "2026-02-27T20:14:10.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22716 (GCVE-0-2026-22716)
Vulnerability from cvelistv5
Published
2026-02-27 19:01
Modified
2026-02-27 19:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to terminate certain Workstation processes.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| VMware | Workstation |
Version: 25H2 < 25H2U1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-27T19:13:38.437019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T19:13:59.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Workstation",
"vendor": "VMware",
"versions": [
{
"lessThan": "25H2U1",
"status": "affected",
"version": "25H2",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-02-26T22:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eOut-of-bound write vulnerability \u003c/span\u003ein VMware Workstation 25H1 and below on any platform allows an \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eactor with non-administrative privileges on a guest VM \u003c/span\u003eto terminate certain\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWorkstation processes.\u003c/span\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to terminate certain\u00a0Workstation processes."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T19:19:19.576Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36986"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "VMware Workstation out-of-bounds write vulnerability",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22716",
"datePublished": "2026-02-27T19:01:44.248Z",
"dateReserved": "2026-01-09T06:54:36.840Z",
"dateUpdated": "2026-02-27T19:19:19.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}