Insights from the Field

Introduction VMSA-2026-0001 addresses three vulnerabilities identified as CVE-2026-22719, CVE-2026-22720, and CVE-2026-22721. The advisory applies to VMware Aria Operations, a platform commonly integrated directly into vCenter environments for monitoring, analytics, and operational visibility. Aria Operations maintains authenticated connections to vCenter, collects configuration and performance data from ESXi hosts, and often integrates with Active Directory or other external

Introduction Disruption doesn’t always announce itself with exploits and remote code execution. Sometimes, it creeps in quietly through a denial-of-service vulnerability, targeting the very control plane that makes modern virtualization work. VMware vCenter Server sits at the heart of nearly every vSphere environment, orchestrating workloads, monitoring infrastructure, and serving as the single pane of glass for managing compute at scale. On July 29, 2025, Broadcom released a

Introduction On May 20, 2025, Broadcom (formerly VMware) released VMSA-2025-0010, a security advisory disclosing a set of newly discovered vulnerabilities affecting a wide range of VMware products, including vCenter Server, ESXi, Workstation, and Fusion. Unlike prior advisories that often spotlight a single critical issue, this release details four distinct vulnerabilities, each posing different operational and security implications depending on the platform and deployment. A

Special recognition to Lee Scites who collaborated on this article Introduction For the first time in Pwn2Own history, a researcher successfully compromised a VMware ESXi host, the very foundation of many enterprise virtualization environments. This occurred at Pwn2Own Berlin 2025, where Nguyen Hoang Thachof STARLabs SG leveraged a zero-day integer overflow vulnerability to execute code on the ESXi hypervisor from a guest VM. This isn’t just a competition milestone; it’s a wa

Introduction Broadcom has issued a moderate-severity security advisory, VMSA-2025-0007, addressing a newly disclosed vulnerability in VMware Tools identified as CVE-2025-22247. This vulnerability affects both Windows and Linux guest operating systems and introduces a risk scenario where a non-privileged user inside a virtual machine could tamper with file operations carried out by VMware Tools. Although this flaw is not exploitable for guest-to-host escape, it may allow local