Hypervisor Vulnerabilities: Attackers Exploit VMware, Not the Hypervisors With the Most CVEs

Reported vulnerabilities against exploited ones

• HypervisorCVEs in NVDKEVper 100
• VMware vCenter Server

  811214.8

• VMware ESXi

  11665.2

• Microsoft Hyper-V

  30251.7

• VMware Workstation

  21320.9

• Xen

  48400.0

• QEMU

  41900.0

• Oracle VirtualBox

  48300.0

• Proxmox VE

  800.0

CVEs whose NVD configuration marks the product as vulnerable (Hyper-V: CVEs whose description names Hyper-V). KEV: entries in CISA’s Known Exploited Vulnerabilities catalog. Per 100: KEV entries per 100 CVEs. CVEs shared by ESXi and Workstation are counted under both.

Ransomware groups name ESXi

8 of the 25 joint #StopRansomware advisories published by CISA and its partners mention ESXi. They describe ESXi variants of the Akira, Play, and Hive encryptors, ransomware deployed on ESXi servers after a vCenter takeover (Daixin Team), and abuse of ESXi administration commands (Medusa). 2 mention Hyper-V.

Why volume and exploitation diverge

A CVE count measures how many flaws a project reports, which depends on its disclosure practice as much as on its code. QEMU and Xen are open source and publish their fixes and advisories in public. Our text classification finds 81 of their 894 distinct CVEs describe a guest affecting the host, yet none has confirmed exploitation in KEV. The exploited set points the other way: in the Daixin Team advisory, actors used privileged accounts to reach vCenter, reset ESXi passwords, and deployed ransomware over SSH. For an attacker, one vCenter or ESXi host is a path to every virtual machine it runs.

What this means for MSPs

The KEV record argues for treating ESXi and vCenter as a separate, faster patching tier: isolate their management interfaces, apply VMware security patches as soon as KEV lists a CVE, and confirm backups of virtual machines are stored outside the hypervisor’s own datastores.

Frequently asked questions

What are the most exploited hypervisor vulnerabilities?

By CISA KEV entries: VMware vCenter Server (12), VMware ESXi (6), and Microsoft Hyper-V (5), as of catalog version 2026.10.16. VMware Workstation has 2, shared with ESXi.

Why do ransomware groups target ESXi?

An ESXi host runs many virtual machines, so an encryptor that targets the host’s virtual machine files affects all of them at once. CISA advisories describe ESXi variants of the Akira, Play, and Hive encryptors, Daixin Team actors deploying ransomware on ESXi servers after taking over vCenter, and Medusa actors abusing ESXi administration commands.

Are open-source hypervisors safer?

The data cannot say. They report far more CVEs (1,383 for Xen, QEMU, VirtualBox, and Proxmox VE) and have 0 KEV entries, which shows where confirmed exploitation has occurred, not which code is more secure.

Has Hyper-V been exploited?

Yes. KEV lists 5 Hyper-V CVEs, including three Hyper-V NT Kernel Integration VSP elevation-of-privilege flaws added on January 14, 2025.

How should an MSP prioritize hypervisor patching?

Patch ESXi and vCenter as internet-adjacent infrastructure, not as back-office servers: restrict vCenter and ESXi management interfaces to a management network, disable unused services such as OpenSLP, and track VMware advisories for KEV additions.

Methodology

References

1. NIST, NVD CVE API 2.0. Accessed October 19, 2026.
2. CISA, Known Exploited Vulnerabilities Catalog. Version 2026.10.16.
3. CISA, #StopRansomware advisories. Accessed October 19, 2026.
4. Microsoft Security Response Center, Security Update Guide (impact ratings for Hyper-V CVEs). Accessed October 2026.