pwn.watch: Broadcom incident updates https://pwn.watch/t/broadcom Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 18 Aug 2026 00:00:00 GMT [high] Broadcom VMware vCenter: Broadcom VMware vCenter Path Traversal Vulnerability https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310 https://pwn.watch/i/broadcom-vmware-vcenter-cve-2026-59310 Tue, 18 Aug 2026 00:00:00 GMT high <p>Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. Added to CISA KEV on 2026-08-18.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-08-18: CISA added CVE-2026-59310 to the KEV catalog (due 2026-08-21).</li></ul> <p><strong>CVEs:</strong> CVE-2026-59310</p> [high] Broadcom VMware Aria Operations: Broadcom VMware Aria Operations Command Injection Vulnerability https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719 https://pwn.watch/i/broadcom-vmware-aria-operations-cve-2026-22719 Tue, 03 Mar 2026 00:00:00 GMT high <p>Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. Added to CISA KEV on 2026-03-03.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-03-03: CISA added CVE-2026-22719 to the KEV catalog (due 2026-03-24).</li></ul> <p><strong>CVEs:</strong> CVE-2026-22719</p> [high] Broadcom VMware Aria Operations and VMware Tools: VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability https://pwn.watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244 https://pwn.watch/i/broadcom-vmware-aria-operations-and-vmware-tools-cve-2025-41244 Thu, 30 Oct 2025 00:00:00 GMT high <p>Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Added to CISA KEV on 2025-10-30.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-30: CISA added CVE-2025-41244 to the KEV catalog (due 2025-11-20).</li></ul> <p><strong>CVEs:</strong> CVE-2025-41244</p> [high] Broadcom Brocade Fabric OS: Brocade Fabric OS Code Injection Vulnerability https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976 https://pwn.watch/i/broadcom-brocade-fabric-os-cve-2025-1976 Mon, 28 Apr 2025 00:00:00 GMT high <p>Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges. Added to CISA KEV on 2025-04-28.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-04-28: CISA added CVE-2025-1976 to the KEV catalog (due 2025-05-19).</li></ul> <p><strong>CVEs:</strong> CVE-2025-1976</p>