VMware security advisories, July 2026

Every VMware (Broadcom) security advisory published in July 2026, from VMware Security Advisories (VMSA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 26
Critical: 6
High: 15
In CISA KEV: 2
CVEs: 26

VMware advisories published in July 2026

Jul 30, 2026
Critical [CVE-2026-47876] VMXNET3 out-of-bounds write vulnerability
Critical9.3
Jul 30, 2026
Critical [CVE-2026-59309] vCenter: VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.
Critical9.8
Jul 30, 2026
Critical [CVE-2026-59310] vCenter directory-traversal vulnerability
Critical9.8ExploitedCISA KEV
Jul 30, 2026
High [CVE-2026-41703] Out-of-bounds read vulnerability
High7.6
Jul 30, 2026
High [CVE-2026-47882] Spring Boot: When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud F…
High8.3
Jul 30, 2026
High [CVE-2026-47858] Spring Boot: Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running applic…
High8.0
Jul 30, 2026
Medium [CVE-2026-59328] Spring Boot: Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Bro…
Medium4.2
Jul 30, 2026
Medium [CVE-2026-59327] Spring Boot: Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain str…
Medium4.4
Jul 30, 2026
Low [CVE-2026-41709] ESX insufficient logging vulnerability
Low2.7ExploitedCISA KEV
Jul 30, 2026
Low [CVE-2026-59326] Spring Boot: The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment v…
Low3.3
Jul 18, 2026
Critical [CVE-2026-47865] Avi Load Balancer: VMware Avi Load Balancer contains an authentication bypass vulnerability.
Critical9.8
Jul 18, 2026
High [CVE-2026-47871] Avi Load Balancer: VMware Avi Load Balancer contains a directory traversal vulnerability.
High8.8
Jul 18, 2026
High [CVE-2026-47870] Avi Load Balancer: VMware Avi Load Balancer contains a privilege escalation vulnerability.
High7.1
Jul 18, 2026
High [CVE-2026-47869] Avi Load Balancer: VMware Avi Load Balancer contains a remote code execution vulnerability.
High8.7
Jul 18, 2026
High [CVE-2026-47868] Avi Load Balancer: VMware Avi Load Balancer contains a local privilege escalation vulnerability.
High7.8
Jul 18, 2026
High [CVE-2026-47867] Avi Load Balancer: VMware Avi Load Balancer contains a remote code execution vulnerability.
High8.7
Jul 18, 2026
High [CVE-2026-47866] Avi Load Balancer: VMware Avi Load Balancer contains an authorization bypass vulnerability.
High8.3
Jul 16, 2026
Critical [CVE-2026-22752] Spring Security: Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.
Critical9.6
Jul 9, 2026
Critical [CVE-2026-47826] BOSH: The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and e…
Critical9.1
Jul 9, 2026
High [CVE-2026-47840] network attacker positioned between UAA and its LDAP directory
High7.5
Jul 9, 2026
High [CVE-2026-47831] BOSH: Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemce…
High7.5
Jul 9, 2026
High [CVE-2026-47830] BOSH: Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privile…
High8.8
Jul 9, 2026
High [CVE-2026-47829] BOSH: Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locall…
High7.8
Jul 9, 2026
High [CVE-2026-47828] BOSH: During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the n…
High8.8
Jul 9, 2026
High [CVE-2026-41857] BOSH: compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the…
High7.8
Jul 9, 2026
Low [CVE-2026-59269] user authenticating to Kubernetes clusters via the Pinniped Supervisor
Low3.8

Get an email when VMware publishes the next one.

See VMware's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about VMware

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.