Vmware Telco Cloud Infrastructure — known CVE vulnerabilities

Every CVE whose affected-product data names Vmware Telco Cloud Infrastructure, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (10)

• CVE-2025-22224 — CVSS 9.3 (critical) — actively exploited: VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious…
• CVE-2025-22225 — CVSS 8.2 (high) — actively exploited: VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary…
• CVE-2026-22719 — CVSS 8.1 (high) — actively exploited: VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute…
• CVE-2026-22720 — CVSS 8.0 (high): VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks…
• CVE-2025-41244 — CVSS 7.8 (high) — actively exploited: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative…
• CVE-2025-22243 — CVSS 7.5 (high): VMware NSX Manager UI is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input validation.
• CVE-2025-22226 — CVSS 7.1 (high) — actively exploited: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious…
• CVE-2025-22244 — CVSS 6.9 (medium): VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.
• CVE-2026-22721 — CVSS 6.2 (medium): VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria…
• CVE-2025-22245 — CVSS 5.9 (medium): VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.