Loading story…
Broadcom addressed three high-severity vulnerabilities in VMware products following notification from the National Security Agency (NSA), highlighting the potential national security implications of these flaws. The vulnerabilities, identified as CVE-2025-41250 affecting vCenter Server and CVE-2025-41251 and CVE-2025-41252 affecting VMware NSX, impact a range of VMware products including NSX, NSX-T, VMware Cloud Foundation, VMware vCenter Server, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure. Security professionals noted that the NSA's involvement suggests a heightened risk of exploitation by nation-state actors, referencing previous incidents where Russian state-sponsored groups targeted VMware vulnerabilities. The two NSX vulnerabilities allow unauthenticated attackers to enumerate valid usernames on affected systems, which can be leveraged in combination with weak or reused credentials to facilitate deeper network penetration. The vCenter Server vulnerability involves SMTP header injection, which could be used in further attack chains. While there is no public evidence that these specific vulnerabilities have been exploited in the wild, experts warn that their combination could enable attackers to progress from reconnaissance to authenticated compromise. The vulnerabilities were disclosed and patched on September 29, 2025, with Broadcom urging customers to apply updates promptly. In parallel, security researchers at NCC Group have published detailed technical analyses of guest-to-host escape vulnerabilities in VMware Workstation, demonstrating how attackers can exploit information leaks and stack-based buffer overflows to execute code on the host operating system from a compromised guest VM. The research includes proof-of-concept exploit development using tools such as Ghidra and WinDBG, providing valuable insights for red teamers and penetration testers. These findings underscore the ongoing risks associated with virtualization platforms, where vulnerabilities can enable attackers to break out of isolated environments and compromise underlying infrastructure. The technical depth of the NCC Group's research highlights the complexity of exploit development for VMware products and the importance of robust vulnerability management. The combination of newly patched vulnerabilities and active exploit research emphasizes the need for organizations to maintain up-to-date security controls and monitor for signs of suspicious activity in virtualized environments. Security teams are advised to review VMware advisories, apply patches without delay, and consider additional hardening measures for critical systems. The involvement of intelligence agencies in vulnerability disclosure further illustrates the strategic importance of securing virtualization technologies in both enterprise and government contexts. Organizations should also be aware of the potential for these vulnerabilities to be used in targeted attacks, particularly by sophisticated threat actors. Ongoing collaboration between vendors, security researchers, and government agencies remains essential to address emerging threats in the virtualization space.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On Sept. 29, 2025, Broadcom issued fixes for the three reported VMware vulnerabilities. The patched flaws included an SMTP header injection issue in vCenter Server and two NSX/NSX-T issues that could allow unauthenticated username enumeration.
Broadcom said the U.S. National Security Agency notified it of three high-severity flaws affecting VMware vCenter Server and VMware NSX/NSX-T. The issues were tracked as CVE-2025-41250, CVE-2025-41251, and CVE-2025-41252.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom has released a series of security updates addressing multiple high-severity vulnerabilities across several VMware products, including VMware Tools, Aria Operations, vCenter, and NSX. The patched vulnerabilities include privilege escalation and information disclosure flaws that could allow attackers to gain elevated access or extract sensitive data from affected systems. In VMware Tools and Aria Operations, three vulnerabilities (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) were disclosed, which can be exploited to escalate privileges to root, steal credentials, and access other guest virtual machines. A zero-day proof-of-concept for a privilege escalation flaw in VMware Tools was published, with reports indicating that Chinese APT groups have leveraged this vulnerability in attacks. Broadcom also addressed two high-severity vulnerabilities in VMware NSX, reported by the U.S. National Security Agency (NSA), which allow unauthenticated attackers to enumerate valid usernames, potentially facilitating brute-force or unauthorized access attempts. Additionally, a high-severity SMTP header injection vulnerability (CVE-2025-41250) in VMware vCenter was patched, which could be exploited by attackers with non-administrative privileges to manipulate notification emails for scheduled tasks. The vulnerabilities in NSX and vCenter highlight the risk of unauthorized access and lateral movement within virtualized environments. Broadcom acknowledged the NSA's role in reporting the NSX flaws and emphasized the importance of timely patching. The company has a recent history of addressing critical VMware vulnerabilities, including those exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest and others reported by the Microsoft Threat Intelligence Center. State-sponsored threat actors and cybercriminal groups, including ransomware operators, are known to actively target VMware vulnerabilities, increasing the urgency for organizations to apply these patches. The coordinated disclosure and rapid patching efforts underscore the ongoing threat landscape facing virtualization infrastructure. Organizations using VMware products are strongly advised to review Broadcom's security advisories and implement the recommended updates to mitigate the risk of exploitation. The vulnerabilities affect both on-premises and cloud-based VMware deployments, making comprehensive patch management essential. Security teams should also monitor for signs of exploitation, especially in environments where patching may be delayed. The publication of proof-of-concept exploits and reports of active targeting by advanced persistent threat groups further elevate the risk profile of these vulnerabilities. Broadcom's advisories provide detailed mitigation steps and highlight the collaborative efforts between vendors and security agencies to protect critical infrastructure. The breadth of affected products demonstrates the need for holistic security strategies in virtualized and cloud environments. Failure to address these vulnerabilities could result in significant compromise of sensitive systems and data.
Jun 29, 2026
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026