VendorsInfrastructure
Broadcom (VMware)
Broadcom owns VMware, maker of the vSphere (ESXi, vCenter) virtualization stack, Workstation and Fusion, Aria operations tools and the Tanzu/Spring application platform, as well as Brocade storage networking.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 29 Jul 2026
- Incidents on record
- 7
Response to exploited bugs
Not rated. 2 reviewed zero-days on record. A grade needs at least 3.
Fixing privately reported bugs
77 range 65–90rank 8 of 20
Provisional 9 private reports, published on 8 dates. Not enough yet for a firm grade.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. 2 reviewed zero-days in the last 36 months. A grade needs at least 3.
- First fix within a day for all 2 zero-days.
- Every supported version fixed within a day for all 2 zero-days.
- First advisory within a day for all 2 zero-days.
- Fixing privately reported bugs: B (77), provisional. Median 70 days from private report to ZDI's public advisory (9 cases). 3 of 9 took longer than ZDI's 120-day deadline.
- 5 of 7 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For 2 of them, fixes for every version came later, up to 34 days.
Response to exploited bugs: sub-scores
- Time to first advisory2 of 2 zero-days within a day792 cases, low confidence, not used for this vendor
- Time to first fix2 of 2 zero-days within a day792 cases, low confidence, not used for this vendor
- Time to fix all versions2 of 2 zero-days within a day792 cases, low confidence, not used for this vendor
- OpennessAdvisories available by RSS. 1 of 1 advisories said the bug was exploited. 2 of 2 fixed zero-days with a public fix date for every version.686 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 70 days from private report to ZDI's public advisory (9 cases)77B9 cases, low confidence, weight 100%
Response fingerprint
Median of 2 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.
Compressed time scale
Counts toward the response grade 2
- 29 Sep 2025VMware Tools and Aria Operations local privilege escalation (VMSA-2025-0015)
- 4 Mar 2025VMware ESXi, Workstation and Fusion VM-escape zero-days (VMSA-2025-0004)
Not graded 5: n-days, unreviewed timelines and end-of-life products
- 29 Jul 2026VMware vCenter Syslog server directory-traversal vulnerability (VMSA-2026-0006)Not graded: n-day
- 24 Feb 2026VMware Aria Operations command injection (VMSA-2026-0001)Not graded: n-day
- 17 Apr 2025Brocade Fabric OS code injection by admin users (BSA-2025-2930)Not graded: unclear
- 17 Sep 2024VMware vCenter Server DCERPC heap overflow and privilege escalation (VMSA-2024-0019)Not graded: n-day
- 17 Jun 2024VMware vCenter Server DCERPC heap overflow (VMSA-2024-0012)Not graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
7 in 24 months, 2 with known ransomware use, 33% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 29 Jul 2026 | VMware vCenter Syslog server directory-traversal vulnerability (VMSA-2026-0006)CVE-2026-59310 | 9.8 | same day | same day | 5d | Fixed | Not graded: n-day |
| 24 Feb 2026 | VMware Aria Operations command injection (VMSA-2026-0001)CVE-2026-22719 | 8.1 | same day | same day | same day | Fixed | Not graded: n-day |
| 29 Sep 2025 | VMware Tools and Aria Operations local privilege escalation (VMSA-2025-0015)CVE-2025-41244 | 7.8 | same day | same day | same day | Fixed | Counts toward grade |
| 17 Apr 2025 | Brocade Fabric OS code injection by admin users (BSA-2025-2930)CVE-2025-1976 | 8.6 | same day | same day | same day | Fixed | Not graded: unclear |
| 4 Mar 2025 | VMware ESXi, Workstation and Fusion VM-escape zero-days (VMSA-2025-0004)CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 | 9.3 | same day | same day | same day | Fixed | Counts toward grade |
| 17 Sep 2024 | VMware vCenter Server DCERPC heap overflow and privilege escalation (VMSA-2024-0019)CVE-2024-38812, CVE-2024-38813 | 9.8 | same day | 34d | 34d | Fixed | Not graded: n-day |
| 17 Jun 2024 | VMware vCenter Server DCERPC heap overflow (VMSA-2024-0012)CVE-2024-37079 | 9.8 | same day | same day | same day | Fixed | Not graded: n-day |
Private reports
Median 70 days, 33% over 120 days, 0 published unpatched
Bugs reported privately to Broadcom (VMware) by ZDI or Project Zero.
120-day deadlinemedian 70d
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 9 Sep 2026 | ZDI-26-647CVE-2026-59346 | Workstation | 14to publication | Yes |
| 29 Jul 2026 | ZDI-26-495CVE-2026-47876 | ESXi | 57to publication | Yes |
| 16 Mar 2026 | ZDI-26-188, ZDI-26-190CVE-2025-41237, CVE-2025-41238 | ESXi; Workstation | 297to publication | Yes |
| 16 Mar 2026 | ZDI-26-189CVE-2025-41236 | ESXi | 299to publication | Yes |
| 17 Jul 2025 | ZDI-25-611CVE-2025-41239 | ESXi | 70to publication | Yes |
| 23 Oct 2024 | ZDI-24-1421CVE-2024-38814 | VMware HCX | 91to publication | Yes |
| 25 Jun 2024 | ZDI-24-882CVE-2024-37087 | vCenter Server Appliance | 537to publication | Yes |
| 31 May 2024 | ZDI-24-526, ZDI-24-527, ZDI-24-528, ZDI-24-529CVE-2024-22267, CVE-2024-22269, CVE-2024-22270 | Workstation | 32to publication | Yes |
| 22 May 2024 | ZDI-24-494CVE-2024-22268 | Workstation | 50to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Broadcom (VMware)'s own alerts
- EmailVMware security-announce mailing list (legacy)Sign up for the vendor’s security notification emails.
- RSSSpring security advisories (Tanzu)Add the advisory feed to a feed reader or chat integration.
- Advisory pageVMware Security Advisories (VMSA) on the Broadcom support portalCheck the advisory page. It has no push channel.
- Advisory pageVMware Security Advisories landing pageCheck the advisory page. It has no push channel.
What we watch
- RSSSpring security advisories (Tanzu)
See sources and health for when each was last read.
Grade not rated.