Loading story…
Broadcom published two security advisories affecting its Support Portal, with notices released through the company's product advisory channel on separate dates. The advisories were identified as support content notifications and tied specifically to the Broadcom support portal, indicating the company disclosed security-related issues or updates for the platform used by customers to access support resources.
Broadcom did not provide a public synopsis in the referenced notices, leaving the exact vulnerabilities, impact, and remediation details unspecified in the available material. Even so, the back-to-back advisories indicate ongoing security maintenance or issue handling for a customer-facing portal that could be relevant to organizations relying on Broadcom support services and account access.
See real exploitation activity before you spend the cycle.
23 events from the most recent confirmed update back to the earliest known activity.
Broadcom issued another security advisory for its Support Portal identified as advisory 37207. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37206. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37205. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37204. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37203. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37202. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37201. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37200. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37199. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37198. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37197. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37186. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37185. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37183. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37182. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37184. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37129. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37128. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued an additional security advisory for its Support Portal identified as advisory 37127. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued another security advisory for its Support Portal identified as advisory 37126. The reference provides no synopsis or technical details about the underlying issue.
Broadcom issued a subsequent security advisory for its Support Portal identified as advisory 37125. The reference does not include a synopsis or further details about the underlying issue.
Broadcom issued a security advisory for its Support Portal identified as advisory 37110. No synopsis or technical details are provided in the reference.
Broadcom issued a security advisory for its Support Portal identified as advisory 23605. The reference provides no synopsis or technical details about the underlying issue.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
23 references tracked. Mallory keeps watching after this page renders.
support.broadcom.com
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom published two security advisories affecting its **Support Portal**, indicating security issues in the company’s customer-facing support platform. The notices were released through Broadcom’s product advisory channel and identify the **Broadcom support portal** as the impacted service, signaling that customers and administrators should review the vendor’s guidance for any required remediation or account-level actions. The available references provide only limited public detail and do not include a synopsis of the underlying flaws, affected components, or exploitation status. Even so, the paired advisories show Broadcom formally disclosed multiple security matters tied to the portal, making the support environment itself the central concern for organizations that rely on Broadcom for case management, downloads, licensing, or other support operations.
Jul 12, 2026
Broadcom issued advisory **VMSA-2026-0001** for **VMware Aria Operations** (formerly *vRealize Operations*), warning of three vulnerabilities affecting Aria Operations and bundled platforms including **VMware Cloud Foundation** and **VMware Telco Cloud**. The most severe issue, **CVE-2026-22719** (CVSS 8.1), is a **command injection** flaw that can be exploited by an **unauthenticated** attacker to execute arbitrary commands and potentially achieve **remote code execution** specifically **while a support-assisted product migration is in progress**. Broadcom released patches and also documented a workaround for CVE-2026-22719 in its response matrix/KB guidance. The advisory also covers **CVE-2026-22720** (CVSS 8.0), a **stored XSS** issue where a user with privileges to create custom benchmarks can inject script to perform administrative actions, and **CVE-2026-22721** (CVSS 6.2), a **privilege escalation** path where a user with vCenter access to Aria Operations can elevate to administrative control. Researchers **Sven Nobis** and **Lorin Lehawany** of **ERNW** were credited with reporting at least part of the findings. Impacted deployments include Aria Operations 8.x and related bundles across Cloud Foundation and Telco Cloud product lines; Broadcom’s fixed versions include updates such as Aria Operations **8.18.6** and Cloud Foundation **9.0.2.0**, and organizations are advised to prioritize upgrades due to the lack of workarounds for the XSS and privilege-escalation issues.
Jun 29, 2026
Broadcom has released **VMSA-2026-0004** to fix three stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations, tracked as `CVE-2026-41722`, `CVE-2026-41723`, and `CVE-2026-41724`. The flaws affect VMware Cloud Foundation Operations and related enterprise cloud environments, including **VMware Aria Operations**, **VMware Telco Cloud Platform**, and **VMware vSphere Foundation** deployments. Broadcom rated the issues **Important**, with a maximum **CVSS v3.1 score of 8.0** and vector `AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`. According to the advisory, an authenticated user with privileges to create policies, views, or text widgets could inject malicious scripts that execute when viewed and potentially perform **administrative actions** inside the platform. Broadcom said the vulnerabilities were privately reported and published remediation guidance, including upgrading **Aria Operations to version 8.18.6**. Organizations running affected VMware management platforms have been urged to review exposed deployments and apply the available patches promptly.
Jun 29, 2026