Openshift Virtualization

Vendor:

First CVE: Jul 29, 2020 · Active for 5 years

11

Total CVEs

More Total CVEs than 89% of tracked products

2.8

Avg CVEs / Year

Higher CVE frequency than 75% of tracked products

6.5

Avg CVSS

Higher Avg CVSS than 32% of tracked products

9.1%

KEV Rate

Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Openshift Virtualization over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jul 29, 2020

5 years ago

Most Recent CVE

Jun 26, 2026

28 days ago

CVE Severity & Scoring

Openshift Virtualization11 CVEs

9%

45%

36%

9%

All CVEs352,294 CVEs

45%

40%

11%

LowMediumHighCritical

Attack Vector

Local5 (45.5%)

Network6 (54.5%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low6 (54.5%)

High5 (45.5%)

Unknown0 (0.0%)

User Interaction

None11 (100.0%)

Unknown0 (0.0%)

Required0 (0.0%)

Privileges Required

Low9 (81.8%)

High0 (0.0%)

None2 (18.2%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (11 CVEs).

11 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through	Oct 10, 2023	7.5	97	YES	YES
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet	Dec 18, 2023	5.9	81	NO	YES
CVE-2026-13325HIGH A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain	Jun 26, 2026	8.5	37	NO	NO
CVE-2026-13201HIGH A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH\|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream	Jun 24, 2026	7.3	31	NO	NO
CVE-2026-13318MEDIUM A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api	Jun 26, 2026	6.4	30	NO	NO
CVE-2020-14316CRITICAL A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to a	Jul 29, 2020	9.9	30	NO	NO
CVE-2026-13208MEDIUM A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace/name) solely from th	Jun 24, 2026	6.5	29	NO	NO
CVE-2026-13218MEDIUM A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without sym	Jun 26, 2026	4.2	25	NO	NO
CVE-2026-13434MEDIUM A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is w	Jun 26, 2026	4.9	24	NO	NO
CVE-2026-13322LOW A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a ne	Jun 26, 2026	3.8	24	NO	NO

View all 11 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (11 CVEs).

CISA KEV

1 CVE

9.1% of CVEs· 97th percentile

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

1 CVE

9.1% of CVEs· 97th percentile

ExploitDB

1 CVE

9.1% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (11 CVEs).

Media Mentions

Signals from CVEs in this product scope (11 CVEs).

Top CNAs Publishing CVEs For Openshift Virtualization

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	KEV	Exploits
4	2	6.7	96.7%	1	2
2	1	7.0	0.3%	0	0
1	1	9.9	1.6%	0	0