ZeusQA
Start free

Known exploited vulnerabilities

Broadcom vulnerabilities attackers have used

Every Broadcom vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 6 Broadcom vulnerabilities as exploited in the wild, 4 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2026-41709, added Oct 28, 2026. Brocade Fabric OS has the most entries (1).

In KEV, all time
6
Added, last 12 months
4
Used in ransomware
1
New CVEs this week
0

By product

Brocade Fabric OS (1), VMware Aria Operations (1), VMware Aria Operations and VMware Tools (1), VMware ESX (1), VMware vCenter (1), VMware vCenter Server (1).

Every Broadcom entry in CISA KEV

  1. CVE-2026-41709

    Added · due

    Broadcom VMWare ESX Insufficient Logging Vulnerability

    Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

  2. CVE-2026-59310

    RansomwareAdded · due

    Broadcom VMware vCenter Path Traversal Vulnerability

    Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.

  3. CVE-2026-22719

    Added · due

    Broadcom VMware Aria Operations Command Injection Vulnerability

    Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution…

  4. CVE-2024-37079

    Added · due

    Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

    Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets…

  5. CVE-2025-41244

    Added · due

    Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

    Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by…

  6. CVE-2025-1976

    Added · due

    Broadcom Brocade Fabric OS Code Injection Vulnerability

    Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works