Bottom line: VMware has released patches for five vulnerabilities across eight products, including two critical vCenter flaws (authentication bypass and RCE via directory traversal), at least one of which is already being actively exploited.
VMware (Broadcom) has released patches for five vulnerabilities affecting eight products. Two of these, in vCenter Server, are rated critical and enable authentication bypass as well as remote code execution; according to the vendor, one of the flaws is already being actively exploited.
Broadcom has released a security update for VMware that addresses five vulnerabilities across a total of eight products. At the center are two critical flaws in vCenter Server: an authentication bypass and a directory traversal vulnerability that can be exploited for remote code execution (RCE). According to VMware, at least one of the vulnerabilities is already being actively exploited in the wild.
For CISOs, the combination of authentication bypass and RCE capability in a central virtualization management component such as vCenter is particularly critical: vCenter typically controls entire ESXi clusters and, with them, the management layer of virtualized infrastructure in data centers. A successful attack on this component could potentially give attackers far-reaching access to virtual machines, network segments, and connected management systems. The confirmed active exploitation further increases the pressure to act, as this is not a purely theoretical threat scenario.
Affected organizations should prioritize applying the available patches to vCenter Server installations and check whether any of the other eight affected products are in use within their own environment. Given the active exploitation, it is also advisable to review logs and access patterns for indicators of compromise attempts that may have already occurred, particularly for externally accessible or insufficiently segmented vCenter instances.
Source: www.security-insider.de · Published August 19, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.