Broadcom fixes three VMware zero-days exploited in the wild found by Microsoft; attackers with admin or root access can chain the flaws to escape a VM's sandbox
Broadcom warned customers today about three VMware zero-days, tagged as exploited in attacks and reported by the Microsoft Threat Intelligence Center.
Context & Ripple Effects
VMware products have repeatedly drawn urgent remediation campaigns: earlier vCenter flaws triggered mass internet scanning and, later, a federal directive to patch or remove affected VMware products amid active exploitation.
This report adds a virtualization-layer risk to that history. Microsoft Threat Intelligence Center’s discovery matters because the flaws were already being used, while their combined effect can break the isolation that makes virtual machines useful as security boundaries.
First-order effects
- Broadcom customers running affected VMware software need to apply the available fixes; organizations with an attacker already holding administrator or root privileges face the immediate risk that those privileges can be used to escape a VM sandbox.
- Broadcom must manage an exploited-in-the-wild security response, while Microsoft’s threat-intelligence findings give defenders a concrete signal to prioritize the affected environment.
Second-order effects
- Security teams will need to treat virtualization hosts and management access as linked exposure: privileged-access review becomes more urgent alongside patch deployment because the reported chain depends on administrator or root access.
- The disclosure reinforces the operational cost of delayed VMware remediation, following prior episodes in which vulnerable vCenter systems drew scanning and agencies were told to patch or remove affected products.
Third-order effects
- If exploited VMware flaws continue to require rapid emergency patching, virtualization isolation will increasingly be managed as a conditional control rather than an assumed hard boundary, with host privilege security carrying more weight.
- The pattern also favors threat-intelligence-led vulnerability prioritization: reports of active exploitation can move a product flaw ahead of vulnerabilities assessed only by technical severity.
The trend: This is one data point in the shift toward prioritizing enterprise infrastructure vulnerabilities by evidence of active exploitation and their potential to undermine isolation boundaries.