Exploited

VMSA-2026-0006.2 — Patch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch per KB 88287; 7.0 extended-support customers should contact Broadcom).

Details →

Lab offline · Awaiting Parts... · 9.1.1 · 78 posts

The Small
Human Cloud

Blog articles, news and useful information on VMware Cloud Foundation, automation and PowerShell — all from the home lab, where everything gets broken and rebuilt first.

Topology · mgmt domain Lab offline · Awaiting Parts...
sddc-manager vcenter nsx vcf-ops esx-01 esx-02 esx-03 esx-04 vsan-datastore 4 hosts · unavailable
Blog posts
78
vExpert since
2020
In IT since
2008
Days since I broke the lab
04

Latest News from the Web

All briefings →
Friday edition

Attackers are getting from a Palo Alto VPN flaw into vCenter and switching off ESXi protections

  • Patch vCenter, and make sure a compromised VPN can't walk straight to it. CVE-2026-59310 (VMSA-2026-0006) is still the priority: 9.1.0.0300 or any later 9.1.x patch, 9.0.2.0100, or 8.0 U3k / U2f. Unit 42's GlobalProtect write-up shows attackers going from the VPN to vCenter and turning off execInstalledOnly on ESXi, so restrict vCenter and ESXi management to jump hosts and alert on changes to that setting.
  • Close out the older exploited advisories while you're there. VMSA-2025-0004 (ESXi VMCI, exploited per Broadcom) is fixed from ESXi 8.0 U3d, 8.0 U2d and 7.0 U3s, so any host left behind on 8.0 or 7.0 needs attention. Also check VCF Operations is on 9.0.2.0 or later (VMSA-2026-0001) and VMware Tools on 13.0.5 or 12.5.4 (VMSA-2025-0015).
  • Set vCenter to UTC before the 9.1.1 upgrade, and turn on Supervisor backups. KB 455439 confirms the "Unable to run vCenter NTP server check" precheck failure is caused by a non-UTC time zone, and switching to UTC in the VAMI is the workaround. If you run Supervisors, tick "Supervisors Control Plane" in the vCenter file-based backup schedule: it's the only way back if KB 457944 bites, and that KB still has no fixed build.
  • Security No new VMSA
  • Releases & KBs Two KBs worth reading
  • Terraform & Packer All quiet
  • Next deadline 8 days
Read today's Latest Tech News →

Code Projects

VMware Explore 2024 Hackathon Winning team

Project and code from the Las Vegas hackathon at VMware Explore 2024.

Explore · Las Vegas 2024 Repo ↗

Simplify VCF Deployment & Operations with Terraform

Session code with examples for deploying VCF and common post-bring-up tasks.

Explore session · 2024 Watch ↗ Repo ↗

Automating VCF Day 1 Operations

Session code covering Day 1 actions via the API and PowerVCF.

Explore session · 2024 Watch ↗ Repo ↗

Presentations

Every slide deck and demo from the events I've been lucky enough to present at.

Decks & demo code Repo ↗
Thanks for visiting

Let's talk tech!

Questions, ideas, or just want to talk VCF? Drop me an email or find me on the socials.

Email me →