All news with #vmware tag

🛡️ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that ransomware gangs are now exploiting a critical VMware vCenter vulnerability (CVE-2026-59310) patched by Broadcom on July 29. The flaw is a directory traversal issue in the vCenter Syslog server that allows unauthenticated attackers to execute arbitrary code; Broadcom urged emergency patching. Security firms reported widespread compromises and CISA added the CVE to its KEV Catalog, ordering rapid remediation across government systems.

🔒 Broadcom has released patches for two vulnerabilities in VMware Workstation and Fusion, including a critical integer-overflow bug (CVE-2026-59346) that could allow arbitrary code execution from a privileged local VM user. A second fix addresses a stack-based buffer overflow in HGFS (CVE-2026-59347). Both flaws require the attacker to have local administrative privileges on the VM and have been fixed in VMware Workstation 26H1u1 and Fusion 26H1u1. Broadcom credited external researchers for reporting the issues and noted no current evidence of in-the-wild exploitation, though recent attacks on VMware products increase urgency.

🔒 Broadcom has released patches addressing five vulnerabilities across multiple VMware products, with three rated as critical. Affected products include vCenter, ESX, Workstation, Fusion, and various cloud and telco platforms. Issues range from authentication bypass and out-of-bounds write enabling remote code execution to syslog-related arbitrary code execution. Administrators should apply fixes from Broadcom's advisory promptly.

🔒 Broadcom released emergency security updates for VMware vCenter, ESX, Workstation, and Fusion to address five vulnerabilities, including three critical flaws that allow authentication bypass, remote code execution, and VM escape. Affected products include VMware Cloud Foundation and various telco platform offerings; administrators should assume prepatched versions are vulnerable and apply fixes immediately. There are no effective workarounds, and some updates require service interruptions or host reboots.

🔒 Broadcom issued security updates for multiple VMware products, including ESX, vCenter, Workstation, and Fusion, addressing three critical vulnerabilities. The highest-severity issues include an authentication bypass (CVE-2026-59309) and a directory traversal allowing code execution (CVE-2026-59310) in vCenter. Additional fixes cover VMXNET3 out-of-bounds write, out-of-bounds read, and insufficient logging flaws in ESX and related products. Broadcom reports no evidence of in-the-wild exploitation and has released patches across VMware Cloud Foundation, vSphere, Workstation, and Fusion versions.

🛡️ Mozilla, Google, Adobe and VMware released updates addressing multiple critical vulnerabilities across Firefox, Chrome, Adobe products, and VMware Avi Load Balancer. Mozilla patched two critical Firefox bugs (CVE-2026-15718, CVE-2026-15719) with exploit code publicly disclosed and fixed in Firefox 152.0.6. Google fixed 15 Chrome vulnerabilities including two critical Ozone use-after-free flaws, and Adobe addressed 88 issues across ColdFusion, Commerce, Experience Manager, and Illustrator. Broadcom remediated a critical authentication bypass in VMware Avi Load Balancer (CVE-2026-47865). Organizations are advised to apply updates promptly to mitigate risk.

🆕 Amazon Elastic VMware Service (EVS) now supports VMware Cloud Foundation (VCF) 9.0 and 9.1, enabling customers to run VCF directly within their Amazon VPC on EC2 bare-metal instances. You retain full control over installation, operations, and management of the VMware virtualization stack and can continue using existing tools, processes, and skills. AWS also launched the Solutions for EVS GitHub repository with examples, templates, and infrastructure-as-code artifacts to accelerate deployments. The release is available in all regions where Amazon EVS is offered.

🔒 Ivanti, Fortinet, SAP, VMware, n8n and dozens of other vendors have released security updates addressing multiple high- and critical-severity flaws that enable authentication bypass, information disclosure, local privilege escalation, and remote code execution. Highlights include a critical Ivanti Xtraction file-name control flaw (CVE-2026-8043), Fortinet authentication and sandbox execution bugs, SAP SQL injection and missing-auth issues, and a TOCTOU local privilege escalation in VMware Fusion. Administrators should prioritize applying the vendor-recommended patches immediately.

🔒 At Pwn2Own Berlin (May 14–16), researchers uncovered 47 zero-day vulnerabilities and shared almost $1.3 million in prize money, with Devcore taking $505,000. The enterprise-focused competition targeted AI databases, coding agents, LLM toolchains and NVIDIA products. Notable wins included exploits against VMware ESXi, Microsoft Exchange, SharePoint and a sandbox escape on Microsoft Edge. ZDI will disclose the findings to vendors, who have 90 days to patch.

🔔 Amazon Elastic VMware Service (Amazon EVS) now provides Microsoft Windows Server licensing entitlements, allowing customers to migrate or create Windows Server VMs in EVS and obtain licensing directly from AWS. Administrators configure an EVS connector to their VMware vCenter and supply VM IDs via the console or CLI. Licensing is charged on a per vCPU‑hour basis and can be added or removed at any time; the feature is available in all Regions where EVS is offered.

🔒 NAKIVO has released Backup & Replication v11.2, introducing an automated real-time replication engine and expanded hypervisor support. The update delivers full compatibility with VMware vSphere 9 and Proxmox VE 9.0 (with 9.1 in scope), plus immutable backups, pre-recovery malware scanning, and air-gapped options to strengthen ransomware resilience. v11.2 also adopts OAuth 2.0 for email notifications and upgrades core platform components to improve stability and recovery speed.

🛡️ This guide summarizes GTIG and Mandiant research on threats targeting the vCenter Server Appliance and ESXi hypervisors, where attackers establish persistence beneath guest OS defenses. It prescribes an infrastructure-centric defense across four phases—benchmarking and base controls, identity management, vSphere network hardening, and logging/forensic visibility—emphasizing Photon OS hardening, mandatory remote telemetry, and strict network segmentation to force detectable friction.

⚠️ CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog on Mar 10, 2026, citing evidence of active exploitation in SolarWinds Web Help Desk, Ivanti Endpoint Manager, and Omnissa Workspace One UEM. Federal civilian agencies were ordered to apply the SolarWinds fix by March 12 and remediate the other two flaws by March 23. The issues include a critical deserialization bug (CVE-2025-26399), an authentication bypass (CVE-2026-1603), and an SSRF (CVE-2021-22054) tied to ongoing threat activity.

⚠️ CISA has added a high‑severity VMware Aria Operations flaw, CVE-2026-22719, to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation; the issue is an unauthenticated command injection that can allow arbitrary command execution and potential remote code execution. Broadcom released fixes for VMware Cloud Foundation, vSphere Foundation 9.0.2.0 and Aria Operations 8.18.6, and provided a shell-script workaround (aria-ops-rce-workaround.sh) for appliance nodes. Public details of in‑the‑wild exploitation and attribution remain scarce. Federal civilian agencies must apply the fixes by March 24, 2026.

🚨 CISA has added a VMware Aria Operations command injection flaw (CVE-2026-22719) to its Known Exploited Vulnerabilities catalog and is treating the issue as exploited in attacks. Broadcom says it is aware of reports of exploitation but cannot independently confirm them. VMware released patches on February 24 and provided a temporary workaround script (aria-ops-rce-workaround.sh) that disables vulnerable migration components; administrators should apply the updates or the workaround immediately.

🔒Recent patches from VMware address several high- and medium-risk vulnerabilities in Aria Operations, Cloud Foundation, and Telco Cloud products. The most serious, CVE-2026-22719, is an unauthenticated command injection that could lead to remote code execution but requires support-assisted product migration to be exploitable, so it is rated high rather than critical. Broadcom recommends upgrading to Aria Operations 8.18.6 and applying corresponding updates for VMware Cloud Foundation and Telco Cloud components to mitigate these issues.

🔒 CISA confirmed ransomware gangs are exploiting a high-severity VMware ESXi sandbox escape (CVE-2025-22225) patched by Broadcom in March 2025 alongside related fixes. The vulnerability permits an attacker with privileges in the VMX process to trigger an arbitrary kernel write and escape the virtual machine sandbox. Organizations are urged to apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue affected products if mitigations are unavailable.

🚨 CISA has added a critical VMware vCenter Server remote code execution flaw (CVE-2024-37079) to its catalog of vulnerabilities exploited in the wild and ordered federal civilian agencies to secure affected systems within three weeks. Patched in June 2024, the issue stems from a heap overflow in the DCERPC implementation of vCenter Server that can be exploited via a specially crafted network packet without credentials or user interaction. Broadcom confirms in-the-wild exploitation and urges immediate patching to the latest vCenter Server and Cloud Foundation releases; no mitigations are available.

⚠️ CISA has added CVE-2024-37079, a critical heap overflow in Broadcom VMware vCenter's DCE/RPC implementation, to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation. The flaw (CVSS 9.8) can enable remote code execution via a crafted network packet; Broadcom released fixes in June 2024 alongside CVE-2024-37080, with related patches issued in September 2024. Broadcom confirms in‑the‑wild abuse and Federal civilian agencies must update to the latest vCenter release by February 13, 2026.

🌐 Amazon EVS now supports deploying multiple VMware NSX Tier-0 Gateways inside an SDDC, enabling enhanced network segmentation and more flexible routing. Multiple Tier‑0 gateways distribute traffic across NSX Edge Clusters to improve performance and scale. Customers can isolate workloads, maintain separate security policies, and conduct upgrades or testing with minimal production impact.