Loading story…
Broadcom issued VMSA-2025-0010 to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by CVE-2025-41225, an authenticated command-execution flaw in vCenter Server with a CVSS 8.8 score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address CVE-2025-41226 and CVE-2025-41227 denial-of-service issues and CVE-2025-41228, a reflected XSS flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that no workarounds exist.
The latest advisory follows earlier VMware warnings over serious vCenter Server weaknesses, including VMSA-2024-0012, which disclosed CVE-2024-37079, CVE-2024-37080, and CVE-2024-37081 as memory-management and corruption flaws that could enable remote code execution in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing CVE-2024-37081, underscoring continued security attention on vCenter exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-05-20, Broadcom published VMware Security Advisory VMSA-2025-0010 covering four vulnerabilities affecting ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure. The most severe, CVE-2025-41225, is an authenticated command-execution flaw in vCenter Server rated CVSS 8.8; updates were released for all affected products and no workarounds were available.
By 2024-07-06, a GitHub repository dedicated to CVE-2024-37081 had been published, indicating public technical material or proof-of-concept activity related to the vCenter Server vulnerability.
On 2024-06-17, VMware published advisory VMSA-2024-0012 for three critical vCenter Server vulnerabilities, CVE-2024-37079, CVE-2024-37080, and CVE-2024-37081. The company said the issues could potentially enable remote code execution, noted ESXi was not affected, and provided patches with no official workaround.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
support.broadcom.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical vulnerabilities were disclosed in **Ivanti Cloud Services Application (CSA)** and **VMware vCenter Server** products, exposing enterprise management platforms to remote compromise. Ivanti said CSA `5.0.2` and earlier contain three flaws—`CVE-2024-11639`, `CVE-2024-11772`, and `CVE-2024-11773`—that can enable authentication bypass, remote code execution, and arbitrary SQL query execution through the administrator browser console, with the most severe issues rated **CVSS 10.0**. Ivanti released fixes in CSA `5.0.3` and urged customers to update immediately. VMware also disclosed two vulnerabilities affecting **vCenter Server** and **VMware Cloud Foundation**: `CVE-2024-38812`, a heap overflow that can allow arbitrary code execution, and `CVE-2024-38813`, which can enable privilege escalation to root. The flaws affect vCenter Server `7.0` and `8.0` as well as VMware Cloud Foundation `4.x` and `5.x`, and can be exploited remotely over the network using specially crafted packets. In both vendor notices, no active exploitation had been confirmed at the time of disclosure, but organizations and service providers were advised to apply vendor-fixed versions without delay because successful attacks could result in full administrative compromise.
Jun 29, 2026
VMware released security updates to fix multiple vulnerabilities across **VMware Aria Operations**, **VMware Cloud Foundation Operations**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform**. The most prominent issue, **`CVE-2026-41722`**, is a stored cross-site scripting flaw in VMware Cloud Foundation Operations with a **CVSS 8.0** rating that can be exploited over the network with low attack complexity, low privileges, and required user interaction. The update also remediates **`CVE-2026-41723`** and **`CVE-2026-41724`**, according to the advisory circulated by EG-FinCIRT and mirrored in multiple notices. Organizations using the affected VMware platforms were urged to test and deploy the patches promptly to reduce exposure across core virtualization and cloud management environments.
Jul 10, 2026
**CISA added CVE-2024-37079, a critical VMware vCenter Server vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog after Broadcom indicated it has evidence of in-the-wild exploitation.** The flaw is a **9.8 CVSS** out-of-bounds write/heap-overflow issue in vCenter Server’s **DCERPC** implementation; an attacker with network access can send specially crafted packets that may result in **remote code execution (RCE)**. CISA’s KEV entry does not attribute exploitation to a specific threat actor and lists ransomware use as **unknown**, but the KEV addition triggers mandatory remediation timelines for US federal agencies. Reporting also noted CISA added multiple other enterprise software issues to KEV in a short span (including vulnerabilities affecting **Versa Concerto** and **Zimbra**, plus developer tools), but the vCenter Server item drew specific attention because it was **patched by Broadcom in 2024** and is still being exploited. Broadcom has not publicly provided details on the scope, victims, or exploitation chain beyond acknowledging observed exploitation, reinforcing the need for organizations running vCenter Server to validate exposure and ensure the relevant updates are deployed.
Jun 29, 2026