{"meta":{"title":"KEV entries: Broadcom","description":"All KEV entries for vendor Broadcom.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":5,"vendor":"Broadcom","entries":5,"shareOfCatalogPercent":0.3,"ransomwareKnown":1,"firstDateAdded":"2025-04-28","latestDateAdded":"2026-08-18","rank":40},"data":[{"cveID":"CVE-2026-59310","vendorProject":"Broadcom","product":"VMware vCenter","vulnerabilityName":"Broadcom VMware vCenter Path Traversal Vulnerability","dateAdded":"2026-08-18","dueDate":"2026-08-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59310","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-59310/"},{"cveID":"CVE-2026-22719","vendorProject":"Broadcom","product":"VMware Aria Operations","vulnerabilityName":"Broadcom VMware Aria Operations Command Injection Vulnerability","dateAdded":"2026-03-03","dueDate":"2026-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77"],"shortDescription":"Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-22719"},{"cveID":"CVE-2024-37079","vendorProject":"Broadcom","product":"VMware vCenter Server","vulnerabilityName":"Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability","dateAdded":"2026-01-23","dueDate":"2026-02-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-787"],"shortDescription":"Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 ; https://nvd.nist.gov/vuln/detail/CVE-2024-37079","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2024-37079"},{"cveID":"CVE-2025-41244","vendorProject":"Broadcom","product":"VMware Aria Operations and VMware Tools","vulnerabilityName":"Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability","dateAdded":"2025-10-30","dueDate":"2025-11-20","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-267"],"shortDescription":"Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 ; https://nvd.nist.gov/vuln/detail/CVE-2025-41244","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-41244"},{"cveID":"CVE-2025-1976","vendorProject":"Broadcom","product":"Brocade Fabric OS","vulnerabilityName":"Broadcom Brocade Fabric OS Code Injection Vulnerability","dateAdded":"2025-04-28","dueDate":"2025-05-19","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602 ; https://nvd.nist.gov/vuln/detail/CVE-2025-1976","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-1976"}]}