VMware ESXi
Virtualization · products/vmware-esxi.yaml · RSS
Latest 9.1.1.0100-25782009 Oct 12, 2026
Latest per track
| Track | Latest | Released |
|---|---|---|
| 9.1 | 9.1.1.0100-25782009 | Oct 12, 2026 |
| 9.0 | 9.0.2.0100-25595025 | Jul 26, 2026 |
| 8.0 | 8.0.3-25595708 | Jul 29, 2026 |
| 7.0 | 7.0.3-24784741 | Jul 15, 2025 |
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 9.1 | 9.1.1.0100-25782009 | May 12, 2026 | Aug 12, 2028 · maintained |
| 9.0 | 9.0.2.0100-25595025 | Jun 17, 2025 | Sep 17, 2027 · maintained |
| 8.0 | 8.0.3-25595708 | Oct 11, 2022 | Oct 11, 2027 · maintained |
| 7.0 | 7.0.3-24784741 | Apr 2, 2020 | Oct 2, 2025 · ended |
| 6.7 | 6.7 Update 3w | Apr 17, 2018 | Oct 15, 2022 · ended |
| 6.5 | 6.5 ESXi650-202403001 | Nov 15, 2016 | Oct 15, 2022 · ended |
| 6.0 | 6.0 EP 25 | Mar 12, 2015 | Mar 12, 2020 · ended |
| 5.5 | 5.5 Update 3k | Sep 19, 2013 | Sep 19, 2018 · ended |
| 5.1 | 5.1 Update 3d | Aug 27, 2012 | Aug 24, 2016 · ended |
| 5.0 | 5.0 Update 3g | Jul 12, 2011 | Aug 24, 2016 · ended |
Recent releases
Security advisories
9.3 CVE-2025-22224 VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual mac…
8.2 CVE-2025-22225 VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
7.1 CVE-2025-22226 VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may…
6.8 CVE-2024-37085 VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured…
6.8 CVE-2024-37086 VMware ESXi contains an out-of-bounds read vulnerability. A
malicious actor with local administrative privileges on a virtual
machine with an existing snapshot may trigger an out-of-bounds read…
8.1 CVE-2024-22273 The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. A malicious actor with access to a virtual machine with storage controllers enabled may…
7.9 CVE-2024-22254 VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may trigger an out-of-bounds write leading to an escape of the sandbox.
7.1 CVE-2024-22255 VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exp…
9.3 CVE-2024-22252 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this…
9.3 CVE-2024-22253 VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this…
7.5 CVE-2023-29552 The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial…
8.2 CVE-2022-31705 VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine m…
8.8 CVE-2022-31696 VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leadi…
3.3 CVE-2022-31699 VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
6.5 CVE-2022-31681 VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
6.5 CVE-2022-23825 Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
5.6 CVE-2022-29901 Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged u…
5.5 CVE-2022-21166 Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
5.5 CVE-2022-21123 Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
5.5 CVE-2022-21125 Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.