Workstation and Fusion 25H2 and 26H1, CVSSv3 8.1–9.3. Neither CVE is in CISA KEV, and the advisory makes no statement on exploitation.
- CVE-2026-59346 9.3 VMXNET3
- CVE-2026-59347 8.1 HGFS
DoUpdate to 26H1u1. There is no workaround.
Latest News from the Web
Weekday edition · archive VCF 9.x · NSX · vSphere · vSAN · IaC
A quiet weekend for releases, but not for security: vCenter CVE-2026-59310 from VMSA-2026-0006 has been in CISA's Known Exploited Vulnerabilities catalogue since 18 August, and CISA lists known ransomware campaign use. New in the knowledge base: VCF Operations 9.1.1 can raise recurring internal-certificate alerts after upgrade (KB 456305). Today's deep dive covers the VCF 9.1 license server.
This is an earlier briefing. Read today's Latest Tech News →
- Security Newest: VMSA-2026-0007 3 Sep · CVE-2026-59310 in CISA KEV
- Releases & KBs 3 upgrade issues KB 456305, KB 442290, NTP precheck
- Terraform & Packer No new versions Ansible vmware.vmware 2.12.0 out (fixes only)
- Next deadline 12 days 31 Oct: AVS BYOL, Insight
Key Takeaways
- Urgent Patch vCenter now. CVE-2026-59310 is in CISA KEV with known ransomware use. Move every reachable vCenter, lab included, to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f or later; also confirm VCF Operations (9.0.2.0+) and VMware Tools (13.0.5 / 12.5.4), which carry older KEV CVEs.
- Before upgrading Three 9.1.x upgrade traps. The vCenter VM must be on hardware version 17 (KB 442290), and Supervisor/VKS estates need the KB 455737 VUM schema check first. Non-UTC vCenters can fail the 9.1.1 NTP precheck, and VCF Operations 9.1.1 may raise recurring internal-certificate alerts after upgrade (KB 456305 workaround).
- This month 31 October deadlines. AVS licence-included nodes must move to VCF BYOL, and Insight's North American deauthorisation takes effect. VCSP Commit starts on 1 November.
- Lab Keep lab networks out of 172.17.0.0/16 and hostnames lowercase. The range clashes with the license server's internal network (KB 441526); uppercase names, DNS gaps or time drift stop it registering (KB 441251).
- Watch KB 457944 fix is still pending. No 9.1.1 patch newer than 12 Oct has appeared; Supervisor/VKS estates should wait for it or run the KB 455737 check before any vCenter 9.1.x upgrade.
Security Advisories 3 open with KEV CVEs
The newest advisory on Broadcom's Security Advisory portal is VMSA-2026-0007 (3 Sep 2026). Exploitation status comes from each Broadcom advisory and the CISA KEV catalogue (release 2026.10.16). Also in KEV since 23 Jan 2026: vCenter CVE-2024-37079 from VMSA-2024-0012.1, which Broadcom marks Closed and says has been exploited in the wild; fixed in vCenter 8.0 U2d / 7.0 U3r and later.
vCenter, ESX, Workstation and Fusion (also VCF, VVF and Telco Cloud), CVSSv3 2.7–9.8, no workarounds. CVE-2026-59310 is in the CISA KEV catalogue (added 18 Aug, due 21 Aug, known ransomware campaign use). The Broadcom advisory itself makes no statement on exploitation. The other four CVEs are not in KEV. First published 29 Jul.
- CVE-2026-59309 9.8 vCenter VMDir auth bypass
- CVE-2026-59310 9.8 vCenter Syslog traversal · KEV
- CVE-2026-47876 9.3 ESX VMXNET3
- CVE-2026-41703 7.6 ESX OOB read
- CVE-2026-41709 2.7 ESX logging
DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch per KB 88287), and ESX to ESXi-9.1.0.0200-25557999, 9.0.2.0100-25595025 or 8.0 U3k / U2f. Treat any unpatched, reachable vCenter as possibly compromised.
Aria Operations / VCF Operations, CVSSv3 6.2–8.1. CVE-2026-22719 is in CISA KEV (added 3 Mar 2026); Broadcom is "aware of reports of potential exploitation" but cannot confirm them.
- CVE-2026-22719 8.1 command injection · KEV
- CVE-2026-22720 8.0 stored XSS
- CVE-2026-22721 6.2 privilege escalation
DoVCF Operations 9.x to 9.0.2.0 or later; Aria Operations 8.x to 8.18.6. Workaround for CVE-2026-22719: KB 430349.
Aria Operations and VMware Tools, CVSSv3 4.9–7.8. CVE-2025-41244 is in CISA KEV (added 30 Oct 2025), and Broadcom reports suspected exploitation.
- CVE-2025-41244 7.8 local privilege escalation · KEV
- CVE-2025-41246 7.6 Tools for Windows
- CVE-2025-41245 4.9 info disclosure
DoVMware Tools to 13.0.5 or 12.5.4; VCF Operations 9.x to 9.0.1.0 or later; Aria Operations 8.x to 8.18.5. No workaround.
All VMware security advisories on Broadcom's support portal →
KB Articles & Known Issues 1 new
- KB 456305: Certificate alerts following upgrade to VCF 9.1.1 After upgrading to 9.1.1, VCF Operations raises "VCF Management Services internal certificate" renewal overdue, rotation failure or expired alerts, sometimes with Identity Broker login errors; cleared alerts return after about an hour. Cause: the Postgres certificate used by the Identity Broker; a fix is planned. Workaround: on a VCF Services Runtime node, delete secret
vidb-postgres-instance-postgres-cert-secretin namespacevidb-externalso it regenerates, wait about 5 minutes, then clear the alerts. - KB 442290: VCF 9.1 vCenter upgrade fails at VCENTER UPGRADE POST INSTALL VM HARDWARE UPGRADE The 9.1 lifecycle task expects the vCenter appliance at virtual hardware 17. If you raised it by hand (for example to 21), the upgrade stops. Fix: snapshot, shut down vCenter, set
virtualHW.version = "17"in the .vmx,vim-cmd vmsvc/reload, power on and retry. - vCenter 9.1.1.0100 known issue: NTP precheck fails on non-UTC time zones Upgrading or patching to 9.1.1 can fail prechecks with "Unable to run vCenter NTP server check" when the vCenter time zone is not UTC. The same notes still list the VUM database reset / Supervisor data-loss issue.
- KB 440630: Upgrade sequence and related issues for VCF and VVF 9.1 The master list for 9.1 upgrades: VCF Operations first, then LCM; NSX estates must use the VCF Installer converge workflow. It indexes KB 440282, 440471, 424533, 440407 and 440459, plus KB 441526 (license server console black screen when DNS or IP sits in 172.17.0.0/16; fixed in license server 9.1.0.0200).
- KB 457944: Supervisor Control Plane VMs missing after 9.1/9.1.1 upgrade Unchanged since the 9 Oct advisory: "fixed in the next release of VCF 9.1.1", with no fixed build named. Recovery needs a vCenter revert and a Supervisor restore, so run the KB 455737 checker before any vCenter 9.1.x upgrade on Supervisor/VKS estates.
Releases & Release Notes 0 new
- VCF 9.1 release notes index The newest entry is still the 12 Oct patches for 9.1.1 components, and no 9.1.2 or 9.2 line is listed. The 9.1.1.x patch releases page was refreshed on 19 Oct, but every component page still lists the same newest patch: SDDC Manager, VCF Operations and VCF Automation on 9.1.1.0200; vCenter, ESX, NSX and vSAN on 9.1.1.0100. Builds are in the side panel, each from that patch's own release notes.
- VMware vSphere Kubernetes Service 3.7.2+v1.36 Still the newest VKS release: a configurable
inPlaceUpdateStrategy(defaultMinimizeSpareNodes), VLAN-backed VPC support and new cluster conditions. Upgrade VKS to 3.7.2 before upgrading the Supervisor to 9.1. Also unchanged: Avi KB 312808 lists 32.1.3 (3 Sep) as newest, and the VKr notes list v1.36.2 and v1.35.6 (17 Aug) as newest.
Automation & IaC
Terraform & Packer 0 new
No new provider or plugin releases. Latest versions, from the Terraform Registry API and GitHub, are in the side panel.
- Other providers: vcd
3.14.2(10 Jul), vra0.17.4(11 Sep), tanzu-mission-control1.4.11(15 Sep). The legacy hashicorp/vsphere provider is still at2.12.0(22 Apr 2025). - Packer vsphere
2.5.0(31 Aug) removed vTPM support (#836), no longer needs an IP on every NIC (#720) and moved to govmomi 0.56.0. - No new VMware Terraform or Packer blog posts or deprecations found.
Automation & API Ecosystem
- Ansible vmware.vmware 2.12.0 A maintenance release with no new modules and no breaking changes, and the latest version on Ansible Galaxy. Fixes: a duplicate name in one job no longer discards that job's whole audit (#427);
vm_infonow warns instead of failing when a VM disappears mid-gather (#431);vm_portgroup_infoVM search was reworked to handle attribute errors (#425). New docs cover VM inventory migration (#429) and case sensitivity (#433). Safe to move your pin up. - VCF.PowerCLI 9.1.1.25718932 Still the current version. Previous: 9.1.0.25380678 (12 May).
- govmomi v0.56.0 Still the current version. vcsim gained cloud-init customisation and power-on during clone; no breaking changes listed.
- Also unchanged: pyVmomi
v9.1.0.0(GitHub, June; Python 3.10+) and Ansible vmware.vmware_rest5.0.0on Ansible Galaxy. - VCF Agentic AI Hub (Code Assist) MCP Server Fling 0.1.1 The newest Fling, downloadable from the Broadcom Support Portal (Flings, "VCF Agentic AI Hub"). A 16 vCPU / 32 GB appliance that serves an MCP server so coding agents generate VCF PowerCLI and VCF Python SDK code against real OpenAPI specs and docs, not invented endpoints or cmdlets. Correction: an earlier version of this briefing named the VCF Inspector Fling (28 Jul) as the newest.
Nested Lab Corner
- Fixing a VCF Services Runtime etcd That Can't Start In a 9.1.1 home lab, patch prechecks failed because the support bundle had written 5.4 million keys (about 2.8 GB) into the runtime's etcd, which then crash-looped. The cleanup TTL never fired because the bucket stayed small in bytes. The fix is lab-only and unsupported; open a case in production.
- How I Fixed a Failed VCF Management Services Platform Deployment On a 2-host 9.1.1 management cluster, the VCF services runtime bootstrap failed after about 45 minutes with
HEALTH0002 … Synthetic checks failed [VCFMS-BOOTSTRAP-999]. Cause: choosing Small (High Availability), which needs three control-plane VMs on separate hosts. Fix: clean up (KB 445132, 447187), redeploy with Small. In two-host labs, never pick an HA size. - License server in labs Keep lab DNS and management IPs out of 172.17.0.0/16 or the license server console can hang on boot (KB 441526, see KBs). TechDocs says the license server cannot be deployed on a standalone ESX host, while William Lam's script does exactly that with OVF Tool for edge cases. Treat it as a lab technique.
- Holodeck 9.1 Holodeck 9.1 (May release) is still current. It supports VCF 9.1.0.0, 9.0.0–9.0.2 and 5.2–5.2.4, VNA clusters, Day 2 VCF Automation and Supervisor deployment, and adds Vault, Authentik and Technitium DNS on HoloRouter. No 9.1.1 build yet.
The VCF 9.1 license server
In VCF 9.1, licensing is no longer something vCenter does on its own. VCF Operations is the licensing control plane, and a separate license server appliance holds and serves the entitlements. One license server can serve many VCF instances and vCenters in a fleet, but you need at least one, and it only works together with VCF Operations. On its own it licenses nothing.
The flow is: VCF Operations issues a time-bound registration key, you deploy the license server OVA through vCenter with that key, the appliance registers with VCF Operations, and you then register it with the VCF Business Services console (vcf.broadcom.com) to assign VCF or VVF entitlements. Deployment takes up to about 20 minutes. Later VCF Operations upgrades also patch the license server and cloud proxy, so you rarely touch it again.
It has two operating modes. In connected mode, usage is sent to Broadcom every 24 hours and an updated licence file is applied automatically, which removes the old 180-day manual acknowledgement. Disconnected mode keeps the manual exchange roughly every 180 days, and the licensing APIs (now open to all customers, not just service providers) let you script that across sites. The license server itself does not talk to the internet; it talks only to VCF Operations, optionally through a proxy.
Requirements that catch people out: a unique FQDN with both A and PTR records, which every vCenter using it must resolve; IPv4 only, as there is no IPv6 support; and the API Key field in the OVA wizard stays blank unless support tells you otherwise. In upgrades from vSphere 8, licences downloaded to the license server cannot be assigned until vCenter is on 9.x, so an evaluation warning in between is expected.
Broadcom's troubleshooting article for a license server that will not register (KB 441251) lists the usual culprits: time drift between VCF Operations, the appliance and the ESX host, which breaks token validation; missing forward or reverse DNS; uppercase characters in hostnames or DNS records; a proxy applied to internal traffic; and deploying the OVA from the standalone ESX host client, which never injects the OVF properties. The symptom is quiet: adding the server bounces back to the Licenses & Registration page and the appliance shows DISCONNECTED. Fix the cause, generate a fresh one-time token and redeploy through vCenter.
Lab gotchas: registration keys expire, so generate one right before deploying (a stale key or time drift can leave the appliance missing from the License Servers list). Avoid 172.17.0.0/16 for DNS or the appliance's network, because it collides with the appliance's internal Docker network (KB 441526, fixed in 9.1.0.0200). For automation, the community Broadcom.Community.VCFLicensing PowerShell module can fetch the registration key, which pairs well with a Packer or OVF Tool pipeline.
Industry
Partnerships & Alliances
- No new OEM, hyperscaler or VCSP announcements in the window.
- VCSP Commit from 1 Nov New VCSP contracts are managed in the Support Portal Licensing module, which needs the Product Administrator role. Insight's North American deauthorisation takes effect on 31 Oct (SDxCentral, 29 Sep).
Features & Technical Blogs
- AI vs. the Fortress: Can Autonomous Agents Breach VMware Security? A theoretical, layer-by-layer attack path against a VKS environment rather than test results. It rates container breakout as likely, and VM escape, hypervisor escape and lateral movement as low or blocked, citing NSX distributed firewalling and HyperArmor's ESX MFA and command controls. Its conclusion: an autonomous breach would need several chained, unpatched zero-days.
- Earlier VCF blog posts from 14–16 Oct (snapshot practice, vSAN ESA and NVMe, certificate management at scale in 9.1.1) remain the most useful recent reading.
Licensing, Business & Industry
- VMware users continue to grapple with cost, licensing headaches Based on the Rimini Street survey published earlier this month. New: 18% already use third-party support, and Rimini itself warns this can mean losing Broadcom security patches.
- No new VMware stories since 13 Oct on The Register or SDxCentral. Ongoing stories are tracked in Open items.
Community & Learning
Community Picks
- Eleven Management Packs in One Day: What VCF Operations Just Became Eleven VCF Operations management packs went GA at 9.1.1.0 on the same day as VCF 9.1.1 (3 Sep). Treat pack versions as part of the 9.1.1 release set when you upgrade. Same day: VCF Operations for Logs Harvester, which pulls log events through the API to search by hostname when events only carry IPs.
- My Inventory – Part 2: NSX ALB, vCloud, Veeam, Proxmox, Hyper-V and the Site Scanner A read-only, agentless inventory tool on one Windows machine, now covering NSX ALB, vCloud Director, Veeam and more, with an encrypted site scanner for unreachable sites.
- Upgrading VCF Management Components to 9.1.1 A runbook for patching 9.1.0 management components to 9.1.1 through VCF Operations: dependency order, prechecks, validation and a known concurrency issue.
- No new posts on williamlam.com since 5 Oct, on Yellow Bricks since #128 (15 Oct) or on CormacHogan.com since 14 Oct.
Community Pulse Unverified reports
- Operations 9.1 SDDC Health adapter instance warning / failure after upgrade A post-upgrade health adapter failure in VCF Operations 9.1, still unanswered.
- Aria vLCM-managed Operations 8.18.7 upgrade to Operations 9.1.x How to move an Aria Lifecycle-managed Operations 8.18.7 deployment to 9.1.x. Relevant if you still run Aria Suite Lifecycle in a lab.
- VCF 9.1.1 and NSX 4.2.3.3 (DFW only) Whether a DFW-only NSX 4.2.3.3 deployment can coexist with VCF 9.1.1. Check the interoperability matrix before mixing versions.
- Why the capacity leg for RAID-0 looks strange on ESA vSAN ESA object layout questions.
- How long durable components take to create during host maintenance The one reply says durable components are created as soon as the host enters maintenance mode, not after the 60-minute repair timer. Relevant when planning rolling ESX patching on vSAN clusters.
- Community blogs report the same 9.1.x upgrade friction: support-bundle bloat breaking the services runtime (VirtualBytes), license server registration needing a fresh key (DinoCloud) and a concurrency issue when patching management components (VCDX #181). Back up and upgrade one component at a time.
Videos, Podcasts & Events
- Virtually Speaking: They Dug a Hole in a Running Data Center Data centre war stories. Also new: AI-Powered Attacks: Why Backups Alone Aren't Enough (13 Oct).
- Upcoming: VMware Explore on Tour Tokyo (20–21 Oct), London (18–19 Nov) and Washington, D.C. (8 Dec, public sector), per the Explore on Tour recap (updated 14 Oct) and Broadcom's Explore 2026 release.
Certification & Learning
- No new exam changes found this week.
- Three VCAP-VCF exams are open for registration VCAP-VCF Administrator (3V0-11.26), Architect (3V0-12.26) and Support (3V0-13.26), USD 250 each via Pearson VUE, exam guides dated 18 Aug.
Sources (68)
- Terraform Registry API
- terraform-provider-vcf README
- terraform-provider-vcf releases
- hashicorp/terraform-provider-vsphere releases
- packer-plugin-vsphere
- packer-plugin-vmware
- VMSA-2026-0006.2
- VMSA-2026-0007
- VCF 9.1 release notes index
- VCF 9.1.1 BOM
- KB 442290
- KB 440630
- KB 457944
- KB 459135
- KB 456620
- KB 312808
- VCF blog critical advisory (9 Oct)
- Deploy a License Server
- VCF 9.1 Licensing blog
- VKS release notes
- Live Cyber Recovery notes
- VCF.PowerCLI
- govmomi releases
- vmware.vmware releases
- vmware.vmware PR #436
- Holodeck release notes
- Virtually Speaking
- VMware Blogs
- VCF blog
- Security blog
- The Register
- SDxCentral
- Channel Dive
- Broadcom Community: VCF
- Broadcom Community: NSX
- Broadcom Community: vSAN
- williamlam.com
- Lam license server post
- VCDX #181
- VirtualBytes
- DinoCloud
- Yellow Bricks
- CormacHogan.com
- ProVirtualzone
- ntpro.nl
- VMSA-2026-0001.1
- VMSA-2025-0015.1
- Broadcom Security Advisory portal
- CISA KEV: CVE-2026-59310
- NVD: CVE-2026-59310
- KB 456305
- KB 441251
- 9.1.1.x patch releases
- AI vs. the Fortress (VCF blog)
- vSAN community: durable components
- VMSA-2024-0012.1
- CISA KEV catalogue
- VKS 3.7 release notes
- VKr release notes
- KB 415405
- VCF Agentic AI Hub Fling
- pyVmomi releases
- lab2prod (15 Oct)
- VCDX #181: management packs
- VCDX #181: Logs Harvester
- ProVirtualzone inventory part 2
- Explore on Tour recap
- Broadcom Explore 2026 release
- vsphere provider 2.18.0 lands, bringing Supervisor namespaces fully into Terraform
- A quiet start to KubeCon week, and how to get NSX TEPs and MTU right first time
- A quiet Sunday before KubeCon, and how VCF 9.1 backs up its own management stack
- A quiet weekend start: KB 457944 finally names its fix, and vmware_rest 5.1.0 is out
- Europe's extra year on vSphere 8 draws scrutiny, and the week ends without new patches
- Broadcom brings back a standalone vSphere: vSphere Express, for up to 128 cores
- VMware Cloud on AWS is moving to 9.1 in 2027, and both Packer plugins get an update
- Telco Cloud Platform folds into VCF, and an open-source stand-in for VDDK appears
- A calm Monday: VMware Tools 13.1.6 is out, and SDDC Manager still waits for its Brotli fix
- A quiet Sunday: VCSP Commit starts today, and SDDC Manager still waits for its Brotli fix
- Broadcom confirms SDDC Manager is its only product critically hit by the Brotli flaw
- Attackers are already going after the Brotli flaw behind Broadcom's SDDC Manager advisory
- Reports say attackers used an ESX logging flaw to hide their tracks
- Broadcom has published a critical VCF advisory for the Node.js Brotli flaw
Tags: Official Broadcom and VMware sources, Press trade press, Community community posts and unverified reports.