Loading story…
Broadcom has released a series of security updates addressing multiple high-severity vulnerabilities across several VMware products, including VMware Tools, Aria Operations, vCenter, and NSX. The patched vulnerabilities include privilege escalation and information disclosure flaws that could allow attackers to gain elevated access or extract sensitive data from affected systems. In VMware Tools and Aria Operations, three vulnerabilities (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) were disclosed, which can be exploited to escalate privileges to root, steal credentials, and access other guest virtual machines. A zero-day proof-of-concept for a privilege escalation flaw in VMware Tools was published, with reports indicating that Chinese APT groups have leveraged this vulnerability in attacks. Broadcom also addressed two high-severity vulnerabilities in VMware NSX, reported by the U.S. National Security Agency (NSA), which allow unauthenticated attackers to enumerate valid usernames, potentially facilitating brute-force or unauthorized access attempts. Additionally, a high-severity SMTP header injection vulnerability (CVE-2025-41250) in VMware vCenter was patched, which could be exploited by attackers with non-administrative privileges to manipulate notification emails for scheduled tasks. The vulnerabilities in NSX and vCenter highlight the risk of unauthorized access and lateral movement within virtualized environments. Broadcom acknowledged the NSA's role in reporting the NSX flaws and emphasized the importance of timely patching. The company has a recent history of addressing critical VMware vulnerabilities, including those exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest and others reported by the Microsoft Threat Intelligence Center. State-sponsored threat actors and cybercriminal groups, including ransomware operators, are known to actively target VMware vulnerabilities, increasing the urgency for organizations to apply these patches. The coordinated disclosure and rapid patching efforts underscore the ongoing threat landscape facing virtualization infrastructure. Organizations using VMware products are strongly advised to review Broadcom's security advisories and implement the recommended updates to mitigate the risk of exploitation. The vulnerabilities affect both on-premises and cloud-based VMware deployments, making comprehensive patch management essential. Security teams should also monitor for signs of exploitation, especially in environments where patching may be delayed. The publication of proof-of-concept exploits and reports of active targeting by advanced persistent threat groups further elevate the risk profile of these vulnerabilities. Broadcom's advisories provide detailed mitigation steps and highlight the collaborative efforts between vendors and security agencies to protect critical infrastructure. The breadth of affected products demonstrates the need for holistic security strategies in virtualized and cloud environments. Failure to address these vulnerabilities could result in significant compromise of sensitive systems and data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A Broadcom support portal security advisory entry associated with these VMware issues was published. This appears to be a later vendor advisory or notification record tied to the previously disclosed vulnerabilities.
Broadcom fixed multiple high-severity VMware NSX vulnerabilities that had been reported by the U.S. National Security Agency. Separate reporting on the same date also described Broadcom addressing multiple VMware vCenter and NSX issues.
Broadcom released fixes for vulnerabilities affecting VMware Tools and Aria Operations, including a privilege escalation issue and an information disclosure flaw. The patch release was reported on the same day as public coverage of the VMware Tools zero-day PoC.
A proof-of-concept exploit for a zero-day privilege escalation vulnerability affecting VMware Tools was published. Public release of exploit details increased the risk of broader abuse of the flaw.
A privilege escalation flaw in VMware Tools was reportedly used in the wild by a Chinese APT before public disclosure. The reporting indicates active exploitation preceded the later publication of a proof-of-concept and vendor patching.
5 references tracked. Mallory keeps watching after this page renders.
support.broadcom.com
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom addressed three high-severity vulnerabilities in VMware products following notification from the National Security Agency (NSA), highlighting the potential national security implications of these flaws. The vulnerabilities, identified as CVE-2025-41250 affecting vCenter Server and CVE-2025-41251 and CVE-2025-41252 affecting VMware NSX, impact a range of VMware products including NSX, NSX-T, VMware Cloud Foundation, VMware vCenter Server, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure. Security professionals noted that the NSA's involvement suggests a heightened risk of exploitation by nation-state actors, referencing previous incidents where Russian state-sponsored groups targeted VMware vulnerabilities. The two NSX vulnerabilities allow unauthenticated attackers to enumerate valid usernames on affected systems, which can be leveraged in combination with weak or reused credentials to facilitate deeper network penetration. The vCenter Server vulnerability involves SMTP header injection, which could be used in further attack chains. While there is no public evidence that these specific vulnerabilities have been exploited in the wild, experts warn that their combination could enable attackers to progress from reconnaissance to authenticated compromise. The vulnerabilities were disclosed and patched on September 29, 2025, with Broadcom urging customers to apply updates promptly. In parallel, security researchers at NCC Group have published detailed technical analyses of guest-to-host escape vulnerabilities in VMware Workstation, demonstrating how attackers can exploit information leaks and stack-based buffer overflows to execute code on the host operating system from a compromised guest VM. The research includes proof-of-concept exploit development using tools such as Ghidra and WinDBG, providing valuable insights for red teamers and penetration testers. These findings underscore the ongoing risks associated with virtualization platforms, where vulnerabilities can enable attackers to break out of isolated environments and compromise underlying infrastructure. The technical depth of the NCC Group's research highlights the complexity of exploit development for VMware products and the importance of robust vulnerability management. The combination of newly patched vulnerabilities and active exploit research emphasizes the need for organizations to maintain up-to-date security controls and monitor for signs of suspicious activity in virtualized environments. Security teams are advised to review VMware advisories, apply patches without delay, and consider additional hardening measures for critical systems. The involvement of intelligence agencies in vulnerability disclosure further illustrates the strategic importance of securing virtualization technologies in both enterprise and government contexts. Organizations should also be aware of the potential for these vulnerabilities to be used in targeted attacks, particularly by sophisticated threat actors. Ongoing collaboration between vendors, security researchers, and government agencies remains essential to address emerging threats in the virtualization space.
Jun 29, 2026
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026
Broadcom has released **VMSA-2026-0004** to fix three stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations, tracked as `CVE-2026-41722`, `CVE-2026-41723`, and `CVE-2026-41724`. The flaws affect VMware Cloud Foundation Operations and related enterprise cloud environments, including **VMware Aria Operations**, **VMware Telco Cloud Platform**, and **VMware vSphere Foundation** deployments. Broadcom rated the issues **Important**, with a maximum **CVSS v3.1 score of 8.0** and vector `AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`. According to the advisory, an authenticated user with privileges to create policies, views, or text widgets could inject malicious scripts that execute when viewed and potentially perform **administrative actions** inside the platform. Broadcom said the vulnerabilities were privately reported and published remediation guidance, including upgrading **Aria Operations to version 8.18.6**. Organizations running affected VMware management platforms have been urged to review exposed deployments and apply the available patches promptly.
Jun 29, 2026