Broadcom vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Broadcom flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-41709 Broadcom VMWare ESX Insufficient LoggingExploited since Oct 28, 2026 · CVSS 2.7
• CVE-2026-59310 Broadcom VMware vCenter Path TraversalExploited since Aug 18, 2026 · ransomware · CVSS 9.8
• CVE-2026-22719 Broadcom VMware Aria Operations Command InjectionExploited since Mar 3, 2026 · CVSS 8.1
• CVE-2024-37079 Broadcom VMware vCenter Server Out-of-bounds WriteExploited since Jan 23, 2026 · CVSS 9.8
• CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe ActionsExploited since Oct 30, 2025 · CVSS 7.8
• CVE-2025-1976 Broadcom Brocade Fabric OS Code InjectionExploited since Apr 28, 2025 · CVSS 8.6

Latest high and critical flaws

• CVE-2026-59310 Broadcom VMware vCenter Path TraversalExploited · Critical 9.8 · Jul 30, 2026
• CVE-2026-8370 Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSerieHigh 8.5 · May 19, 2026
• CVE-2026-3991 Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15, may be susceptible to a ElevatiHigh 7.8 · Mar 30, 2026
• CVE-2026-22719 Broadcom VMware Aria Operations Command InjectionExploited · High 8.1 · Feb 25, 2026
• CVE-2025-13917 WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise High 7 · Jan 28, 2026
• CVE-2025-69275 Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps High 7.1 · Jan 12, 2026
• CVE-2025-69273 Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3.High 8.7 · Jan 12, 2026
• CVE-2025-69269 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allowsHigh 7.1 · Jan 12, 2026
• CVE-2025-69267 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path TraversaHigh 8.8 · Jan 12, 2026
• CVE-2025-36553 A buffer overflow vulnerability exists in the CvManager functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47.High 8.8 · Nov 17, 2025
• CVE-2025-36463 Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior tHigh 7.3 · Nov 17, 2025
• CVE-2025-36462 Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior tHigh 7.3 · Nov 17, 2025
• CVE-2025-36461 Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior tHigh 7.3 · Nov 17, 2025
• CVE-2025-36460 Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior tHigh 7.3 · Nov 17, 2025
• CVE-2025-32089 A buffer overflow vulnerability exists in the CvManager_SBI functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.High 8.8 · Nov 17, 2025
• CVE-2025-31649 A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus pHigh 8.7 · Nov 17, 2025
• CVE-2025-31361 A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to 5.15.14.19 and DellHigh 8.7 · Nov 17, 2025
• CVE-2025-10847 DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component.High 8.4 · Oct 1, 2025
• CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe ActionsExploited · High 7.8 · Sep 29, 2025
• CVE-2025-51005 A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1.High 7.5 · Sep 23, 2025
• CVE-2025-51006 Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c.High 7.8 · Sep 22, 2025
• CVE-2025-9059 The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.High 8.8 · Sep 11, 2025
• CVE-2025-7398 Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036.High 8.6 · Jul 17, 2025
• CVE-2025-6391 Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files.High 7.1 · Jul 17, 2025
• CVE-2025-5333 Remote attackers can execute arbitrary code in the context of the vulnerable service process.Critical 9.5 · Jul 6, 2025