DanSec

Vendor

VMware

In 40 briefs, most recently 29 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

26 VMware vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 9 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
  2. Lazarus Group's FlashHole watering-hole campaign, Tor exit relay hijacking, and Zeabur's second breach in two months.
  3. Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
  4. JetBrains TeamCity flaw breached Cadence and exposed AWS credentials; Trezor's shipper ShipMonk leaked 67,000 US customer records; Magento zero-day backdoors …
  5. IDScan breach exposing 153M driver's licenses, rogue AI agents hijacking a German wiki, and actively exploited Citrix NetScaler flaw.
  6. Manchester Airports Group ransomware leak of 8.8M people, Thomson Reuters C-Track breach, and Coder Terraform supply-chain attack.
  7. Sakura Internet and CareCloud breaches, Dahua camera compromises, and the Cl0p PTC Windchill extortion campaign, plus actively exploited Windows IKE and GitLab …
  8. Trezor customer data breach via ShipMonk, actively exploited VMware vCenter Syslog RCE, and Apple mercenary spyware alerts.
  9. Ceva Logistics warehouse cyberattack, LiteLLM supply chain breach hitting 2,500+ orgs, and Lazarus Group Windows zero-day exploit.
  10. Anthropic's Claude agent breaching real organizations, the Brinks Home ShinyHunters breach, and a critical JetBrains TeamCity authentication bypass …
  11. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  12. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  13. Dutch and Spanish police bust major fraud rings; Firefox, Zoom, SharePoint and LegacyHive Windows zero-day flaws. Plus OkoBot and AsyncAPI npm supply chain …
  14. SonicWall SMA 1000 zero-days, Microsoft's record 622-flaw Patch Tuesday and nearly 300 fake GitHub infostealer repos.
  15. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  16. The Foxconn ransomware breach, Fragnesia Linux kernel root exploit, and NGINX unauthenticated RCE flaw, plus Microsoft's May Patch Tuesday fixes.
  17. Malicious checkmarx/kics Docker images, a self-propagating npm worm stealing developer tokens, and Lotus Wiper attacks on Venezuela's energy sector.
  18. Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
  19. LexisNexis data leak, UMMC ransomware outage, and FBI/Europol seizure of the LeakBase forum.
  20. Drone strikes hit AWS data centers in UAE and Bahrain, AkzoNobel and LexisNexis breaches, and VMware Aria flaw CVE-2026-22719 exploited in the wild.
  21. ShinyHunters breaches at Wynn Resorts and CarGurus, a worm-like Sandworm_Mode npm supply chain attack, and Reddit's £14.47M UK fine.
  22. Mexican government breach claim, Notepad++ update hijacking distributing a backdoor, and a critical n8n flaw allowing host takeover.
  23. Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
  24. Microsoft Windows 11 UNMOUNTABLE_BOOT_VOLUME boot failures after January 2026 Patch Tuesday, and VMware flaw under active exploitation, plus ISC scanning …
  25. Nike breach claimed by WorldLeaks, Sandworm's failed DynoWiper attack on Poland's grid, and CISA KEV addition for VMware vCenter CVE-2024-37079.
  26. IDHS exposing ~700,000 residents' health data, a VMware ESXi zero-day exploited via SonicWall VPN, and Trend Micro Apex Central RCE patches.
  27. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  28. Inotiv ransomware theft, Marquis breach affecting 780,000+, and React2Shell (CVE-2025-55182) exploitation by China-linked actors.
  29. The Ribbon Communications breach, Cisco IOS XE webshell attacks, the Motex Lanscope zero-day exploited by Tick, and Conti extradition news.
  30. Ribbon Communications nation-state breach, Conduent 10.5M-record ransomware-claimed breach, and China-linked VMware Tools zero-day exploitation.
  31. Clop's Oracle E-Business Suite extortion campaign, the WestJet and Allianz Life breaches, and the WireTap/Battering RAM physical attack on Intel SGX and AMD …
  32. UK seizure of £5.5bn in Bitcoin, WestJet passport data breach, and Asahi cyberattack disrupting Japanese production.
  33. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  34. Scattered Spider targets VMware ESXi hypervisors for ransomware; Tridium Niagara flaws expose smart buildings; Post SMTP WordPress plugin takeover bug.
  35. Allianz Life breach, WordPress Post SMTP flaw exposing 200k+ sites, and ToolShell SharePoint exploits.
  36. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.
  37. The $27M BigONE crypto exchange breach, Salt Typhoon's nine-month Army National Guard intrusion, and Cisco ISE CVE-2025-20337 (CVSS 10) with other …
  38. Ahold Delhaize breach hits 2.2M people, Cloudflare mitigates record DDoS, Russia throttles Cloudflare, Citrix Bleed 2 exploited.
  39. Cellcom outage cyberattack, SK Telecom malware breach exposing 27M USIM records, and RVTools supply chain attack delivering Bumblebee malware.
  40. Procolored printer drivers spread malware for six months, Coinbase offers $20M bounty after extortion, and Intel CPUs face new Spectre-style flaws.