VMware ESXi Vulnerability: What MSPs Need to Know About VMware Engine

What Happened

Google Cloud published security bulletin GCP-2026-050 for VMware Engine on July 29, 2026. The bulletin cites multiple critical vulnerabilities in VMware ESXi and vCenter from Broadcom advisory VMSA-2026-0006. This VMware ESXi vulnerability was privately reported to Broadcom, and there are no known workarounds.

CISA has added CVE-2026-59310 and CVE-2026-41709 to its Known Exploited Vulnerabilities database. Google is applying patches supplied by Broadcom and recommends customers monitor workloads on VMware Engine for unusual activities.

Timeline

• 2026-07-29Google Cloud published GCP-2026-050, citing Broadcom advisory VMSA-2026-0006 for critical VMware ESXi and vCenter vulnerabilities.

Who Is Affected

Google Cloud's bulletin is about VMware Engine deployments running VMware ESXi and vCenter. If you have clients with workloads on VMware Engine, you'll need to verify that the patches have been applied.

Google says that once patched, your VMware Engine deployments should be running vCenter and ESXi 8.0 U3k. That's the target version to confirm after the update. Until a deployment reaches that version, treat it as affected.

ESXi and vCenter sit beneath the workloads. In general, a vulnerability in that layer can expose multiple virtual machines at once, so the blast radius for an MSP is wider than a single application issue.

To check an environment, you need to know which workloads run on VMware Engine and which do not. In general, an up-to-date inventory of virtual machines and their dependencies makes incident response faster and cleaner. That inventory is also what you use to confirm every affected deployment has been patched.

Why the VMware ESXi Vulnerability Matters

For MSPs, hypervisor and management plane vulnerabilities are a different category from ordinary software bugs. A compromise in ESXi or vCenter can give an attacker control over the infrastructure that runs client workloads, not just one application.

Google's bulletin lists no workarounds, which means patching is the only mitigation. That makes the update process the main thing to track this week. In general, VMware infrastructure should be patched on a defined schedule, and critical advisories should move to the front of the queue.

CISA's Known Exploited Vulnerabilities listing for two of the CVEs is a strong signal that the vulnerabilities are being actively exploited. That does not mean every unpatched system is compromised, but it means the risk window is real.

The practical problem for an MSP is scale. A single VMware environment can host dozens of client servers, and an unpatched hypervisor puts all of them at risk. That is why tracking vendor advisories, knowing the patched version, and confirming the update is applied are core tasks, not optional steps.

It also helps to have a record of what was patched and when. In general, documentation makes it easier to answer client questions and to show that the issue was handled promptly.

Technical Details

Google Cloud lists the following CVEs from Broadcom advisory VMSA-2026-0006: CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709. The advisory is rated critical.

The affected products are VMware ESXi and vCenter. Google says that once patched, VMware Engine deployments should be running vCenter and ESXi 8.0 U3k.

The vulnerabilities were privately reported to Broadcom, and there are no known workarounds. Google doesn't describe an attack vector in bulletin GCP-2026-050.

Broadcom advisory VMSA-2026-0006 is the authoritative reference for the vulnerabilities. Google Cloud's bulletin is written for VMware Engine customers and tells them what Google is doing and what to check after patching.

What to Do This Week

Start with the VMware Engine deployment status. The patching is being handled by Google, so the main work for you is confirmation and monitoring. In general, the same discipline applies to any ESXi or vCenter you manage directly: know the version, know the advisory, and have a patching date.

1. Review Google Cloud bulletin GCP-2026-050 and Broadcom advisory VMSA-2026-0006 for your VMware Engine deployments.
2. Apply any necessary updates as they become available. Google is applying patches supplied by Broadcom, so confirm your deployment has received them.
3. Confirm your VMware Engine deployments are running vCenter and ESXi 8.0 U3k after patching.
4. Monitor workloads on VMware Engine for unusual activities, as Google recommends.
5. Review your patching process for ESXi and vCenter. In general, these systems should be on a fast patch cycle because they sit beneath all virtual workloads.

What to Tell Clients

Google Cloud has published a critical advisory for VMware Engine. Multiple vulnerabilities in VMware ESXi and vCenter have no known workarounds, and Google is applying patches.

Once patched, your VMware Engine deployment should be running vCenter and ESXi 8.0 U3k. We are confirming that your environment is at that version.

We are also monitoring for unusual activity on your workloads, as Google recommends. If you see anything unexpected in the meantime, let us know.

If clients ask whether they should do anything, the honest answer is that Google is patching the platform and you are confirming the result. In general, clients appreciate a short, factual update over silence while you work through an advisory.

Frequently Asked Questions

Sources

• GCP-2026-050Google Cloud Security Corrected · Official
• GCP-2026-050Google Cloud Security Corrected · Official