Loading story…
VMware security advisories prompted national CERT notifications covering four vulnerabilities — CVE-2026-41703, CVE-2026-47876, CVE-2026-59309, and CVE-2026-59310 — affecting a wide range of products, including VMware Cloud Foundation, VMware vSphere Foundation, VMware ESXi, VMware vCenter, VMware Workstation, VMware Fusion, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure. South Korea’s KISA published a remediation matrix showing that the issues span both datacenter and endpoint virtualization platforms.
The published guidance maps each flaw to fixed builds, update releases, and vendor knowledge base patches, including ESXi80U3i-25205845, ESXi80U3k-25595708, vCenter 8.0 U3k, vCenter 8.0 U2f, KB449886, and KB88287. Separate CERT-PY notices also warned about VMware product vulnerabilities, reinforcing the need for organizations running VMware infrastructure to identify affected versions and apply the corresponding updates across exposed environments.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
KISA published a VMware security update advisory mapping affected products to remediated versions for CVE-2026-41703, CVE-2026-47876, CVE-2026-59309, and CVE-2026-59310. The advisory lists fixes across VMware Cloud Foundation, vSphere Foundation, ESXi, vCenter, Workstation, Fusion, and Telco Cloud products.
Broadcom revised its advisory for CVE-2026-59310 on August 3 to add VMware vCenter 8.0 U2f express patches. The update expanded the listed fixed releases after the company had initially said on July 29 that it had not observed exploitation.
QUIRSO reported successful compromises of VMware vCenter appliances via CVE-2026-59310, observing path traversal activity followed by deployment of a malicious cron job and reverse_ssh for persistence and outbound connectivity. The firm said compromised systems first contacted attacker-controlled domains on August 3 and identified up to 361 victim IPs across 47 countries.
CERT-PY published a subsequent advisory, also titled "Vulnerabilidades en productos VMware." The provided reference does not expose further technical details, so only the publication of the advisory can be anchored.
After Broadcom disclosed VMSA-2026-0006 on July 29, DefusedCyber observed increased fingerprinting activity against exposed VMware vCenter instances, including requests to /sdk/ using RetrieveServiceContent and probes of /websso/. The activity was described as reconnaissance for vulnerable targets rather than confirmed exploitation.
CERT-PY published an advisory titled "Vulnerabilidades en productos VMware" covering VMware product vulnerabilities. The provided reference does not include additional event details beyond the existence of the advisory.
Quirso released a generic YARA rule to help identify reverse_ssh builds used by attackers after compromising VMware vCenter servers via CVE-2026-59310. The firm also advised organizations to investigate detections by checking for unauthorized installations, unexpected outbound connections, and suspicious execution activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
15 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecsirt.sk
Open sourcesecurityweek.com
Open sourceheise.de
Open sourcemedium.com
Open sourceboho.or.kr
Open sourcecert.gov.py
Open sourcecert.gov.py
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026
VMware released security updates to fix multiple vulnerabilities across **VMware Aria Operations**, **VMware Cloud Foundation Operations**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform**. The most prominent issue, **`CVE-2026-41722`**, is a stored cross-site scripting flaw in VMware Cloud Foundation Operations with a **CVSS 8.0** rating that can be exploited over the network with low attack complexity, low privileges, and required user interaction. The update also remediates **`CVE-2026-41723`** and **`CVE-2026-41724`**, according to the advisory circulated by EG-FinCIRT and mirrored in multiple notices. Organizations using the affected VMware platforms were urged to test and deploy the patches promptly to reduce exposure across core virtualization and cloud management environments.
Jul 10, 2026
VMware administrators were urged to rapidly patch **vCenter Server**, **Cloud Foundation**, and **Aria Automation** after disclosure and active exploitation of critical vulnerabilities including `CVE-2023-34048` and `CVE-2023-34063`. `CVE-2023-34048` is a critical unauthenticated remote code execution flaw in vCenter's DCE/RPC implementation, while `CVE-2023-34063` is a critical missing access control issue that can let an authenticated attacker access remote organizations and workflows; `CVE-2023-34056` was also cited as a lower-severity vCenter issue. CSIRT.SK reported that more than 2,000 vCenter servers were exposed and noted CISA had highlighted active exploitation of `CVE-2023-34063`, with defenders advised to patch immediately, upgrade Aria Automation to **8.16**, and closely monitor TCP ports **2012**, **2014**, and **2020** because no mitigation exists for `CVE-2023-34048` beyond updating. VMware's Cloud Foundation guidance tied remediation to a detailed compatibility matrix for applying vCenter patches with the **Async Patch Tool (AP Tool)** across supported **VCF** releases and SKUs, including VCF on VxRail. The matrix lists supported vCenter 7.0 U3 and 8.0 U1/U2/U3 patch bundles, flags cases with **no upgrade path** for some major VCF lines, and notes that certain **VCF 5.2/5.2.1** upgrades must be performed through **Flexible BOM** instead of AP Tool. VMware also specifically recommended moving **VCF 5.2.1** environments to **vCenter 8.0 U3d** rather than the bundled **8.0 U3c** to address vulnerabilities disclosed in **VMSA-2024-0019.2**, while warning that some vCenter 7.0 U3 patching operations also update multiple **SDDC Manager** services.
Jul 24, 2026