Telco Cloud Platform
Monthly
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.
Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.
Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical.
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch.
Privilege escalation in VMware Aria Operations allows authenticated users with vCenter access to escalate their privileges to administrative level within Aria Operations. The vulnerability affects multiple Broadcom products including Telco Cloud Platform, Aria Operations, and Cloud Foundation, requiring administrative intervention but no user interaction to exploit. Patches are available through VMSA-2026-0001.
Stored XSS in VMware Aria Operations allows authenticated users with benchmark creation privileges to inject malicious scripts and execute arbitrary administrative actions within the platform. This vulnerability affects VMware, Broadcom, and Telco Cloud Infrastructure products with a CVSS score of 8.0, requiring user interaction to trigger the attack. Patches are available through VMSA-2026-0001.
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated remote attackers to execute arbitrary commands during support-assisted product migration. KEV-listed with patches available, this vulnerability targets the infrastructure monitoring platform that has visibility into the entire virtualized environment.
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.
VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.
VMware NSX Manager UI is vulnerable to stored cross-site scripting (XSS) attacks via improper input validation in user-controllable fields (CWE-79). An authenticated attacker with high privileges can inject malicious scripts that persist in the application and execute in the browsers of other users, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. With a CVSS score of 7.5 and network-accessible attack vector, this vulnerability poses a moderate-to-high risk to NSX Manager deployments, particularly in multi-user environments.
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowing VM administrators to leak memory from the VMX process on the host.
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes, enabling escape from the VMX sandbox to the ESXi kernel.
VMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrators on VMs to escape the sandbox and execute code as the VMX process on the host.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.
Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-issued Broadcom/VMware advisory and the CVSS 9.3 score reflect a critical host-compromise impact.
Authentication bypass in VMware vCenter's Directory Service (vmdir) lets an attacker with network reachability to vCenter defeat the authentication algorithm and obtain unauthorized access without valid credentials. Because vCenter is the central management plane for vSphere environments, this exposes control over the entire virtual estate; the flaw is remotely exploitable with no privileges or user interaction (CVSS 9.8). At time of analysis there is no public exploit identified and it is not listed in CISA KEV, but the reporting vendor (VMware/Broadcom) rates it critical.
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform) arises from a directory traversal flaw in the Syslog server component, enabling any actor with network reach to vCenter to run arbitrary code. The CVSS 9.8 vector indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not yet listed in CISA KEV, but the vCenter management plane's central role makes this a top-priority patch.
Privilege escalation in VMware Aria Operations allows authenticated users with vCenter access to escalate their privileges to administrative level within Aria Operations. The vulnerability affects multiple Broadcom products including Telco Cloud Platform, Aria Operations, and Cloud Foundation, requiring administrative intervention but no user interaction to exploit. Patches are available through VMSA-2026-0001.
Stored XSS in VMware Aria Operations allows authenticated users with benchmark creation privileges to inject malicious scripts and execute arbitrary administrative actions within the platform. This vulnerability affects VMware, Broadcom, and Telco Cloud Infrastructure products with a CVSS score of 8.0, requiring user interaction to trigger the attack. Patches are available through VMSA-2026-0001.
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated remote attackers to execute arbitrary commands during support-assisted product migration. KEV-listed with patches available, this vulnerability targets the infrastructure monitoring platform that has visibility into the entire virtualized environment.
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.
VMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the gateway firewall due to improper input validation.
VMware NSX Manager UI is vulnerable to stored cross-site scripting (XSS) attacks via improper input validation in user-controllable fields (CWE-79). An authenticated attacker with high privileges can inject malicious scripts that persist in the application and execute in the browsers of other users, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. With a CVSS score of 7.5 and network-accessible attack vector, this vulnerability poses a moderate-to-high risk to NSX Manager deployments, particularly in multi-user environments.
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowing VM administrators to leak memory from the VMX process on the host.
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes, enabling escape from the VMX sandbox to the ESXi kernel.
VMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrators on VMs to escape the sandbox and execute code as the VMX process on the host.