Broadcom released patches for critical vulnerabilities affecting a host of VMware products, including its telecom cloud suite.

The most critical flaws concern an authentication bypass vulnerability in VMware vCenter's VMware Directory Service (CVE-2026-59309) and a directory-traversal vulnerability (CVE-2026-59310), which could allow bad actors to read private files on vCenter's Syslog server. Both vulnerabilities were rated with a CVSSv3 base score of 9.8, and affect the following services within VMware's vCenter umbrella: Cloud Foundation, vSphere Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure.

Other issues in the Broadcom alert include an out-of-bounds write vulnerability in VMware ESX (CVE-2026-47876), which opens up the VMXNET3 virtual network adapter to malicious code executions. The list also includes an out-of-bounds read vulnerability (CVE-2026-41703) affecting ESX, Workstation, and Fusion where a malicious actor with virtual machine (VM) deployment privileges could trigger an out-of-bounds read and enable an information disclosure or a denial-of-service (DoS) condition of the host process. Rounding out the list is an insufficient logging vulnerability (CVE-2026-41709) in VMware ESX where a malicious administrator may be able to perform operations without any being logged.

Users were advised to download the latest patched versions as listed by Broadcom here.

The cavalcade of vulnerabilities comes after a similar litany where discovered this month in VMware's Avi Load Balancer multicloud application delivery platform. An earlier vCenter flaw was flagged as a federal threat in January.

A backdoor exploit in VMware vSphere also saw the release of a security briefing from the National Security Agency (NSA), which warned actors could grab cloned VM snapshots for credential extraction and create hidden, rogue VMs via vCenter servers and the VMware ESXI hypervisor.