FAIL › dossier
Broadcom
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 50%
Broadcom has a history of high-severity vulnerabilities in its products, including remote code execution and privilege escalation issues.
PROFILE
CategorySemiconductorWhat they doBroadcom Inc. is a global leader in semiconductor solutions, designing and manufacturing a wide range of chips for various computing, networking, and storage applications.
SECURITY POSTURE
Broadcom has faced multiple high-severity vulnerabilities in its products, indicating potential weaknesses in its security posture.
Notable failures
- CVE-2026-22719 (high [RCE])
- CVE-2024-37079 (high [RCE])
- CVE-2025-41244 (high [RCE])
- CVE-2025-1976 (high [RCE])
- CVE-2026-57216 (medium)
- CVE-2026-57211 (medium)
Patterns: Unpatched command injection flaws; Out-of-bounds write vulnerabilities; Local non-admins escalating privileges; Code injection vulnerabilities
FAILURE HISTORY · 16
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-10-08 | CVE-2026-87684 | critical | A stack-based buffer overflow in Brocade Fabric SNMP daemons before 10.0.1 allows remote unauthenticated attackers to crash the daemon or execute arbitrary code via crafted SNMPv3 packets. |
| 2026-08-18 | CVE-2026-59310 | high | Unauthenticated attackers exploited a path traversal flaw in VMware vCenter to execute arbitrary code and establish persistent backdoors. |
| 2026-10-08 | CVE-2026-87659 | critical | A critical authorization bypass in Brocade Fabric OS before 10.0.1 lets compromised switches bypass admin authentication and execute actions like password resets and reboots. |
| 2026-03-03 | CVE-2026-22719 | high | Broadcom's VMware Aria Operations had an unpatched command injection flaw exploited in the wild, allowing remote code execution during product migrations. |
| 2026-01-23 | CVE-2024-37079 | high | Broadcom's VMware vCenter Server exploited for RCE due to unpatched out-of-bounds write in DCERPC protocol |
| 2025-10-30 | CVE-2025-41244 | high | Broadcom's VMware Aria Operations and VMware Tools allow local non-admins to escalate to root via unpatched SDMP vulnerability. |
| 2025-04-28 | CVE-2025-1976 | high | A Broadcom Brocade Fabric OS vulnerability allows local admins to execute arbitrary code with root privileges, and is currently being exploited in the wild. |
| 2026-07-10 | CVE-2026-57216 | medium | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol pat |
| 2026-07-10 | CVE-2026-57211 | medium | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extensio |
| 2026-08-27 | CVE-2026-47875 | medium | CVE-2026-47875: Applications that deserialize execution contexts with Jackson2ExecutionContextSt |
| 2024-07-09 | CVE-2024-3596 | critical | CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local atta |
| 2022-12-08 | CVE-2022-33186 | critical | CVE-2022-33186: A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, |
| 2021-09-16 | CVE-2021-40438 | critical | CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an orig |
| 2019-01-18 | CVE-2019-3773 | critical | CVE-2019-3773: Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of al |
| 2019-01-18 | CVE-2019-3774 | critical | CVE-2019-3774: Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were |
| 2018-04-11 | CVE-2018-1273 | critical | CVE-2018-1273: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older |
SENTIMENT · TRUSTED SOURCES
synthesisneutral+0.00
No coverage found for CVE-2019-3774 in the provided sources; sources contain unrelated CVEs or generic pages.
synthesissevere-fallout-0.60
Broadcom faced severe fallout from CVE-2019-3773, a critical XXE vulnerability in Spring Web Services that exposed untrusted XML data processing flaws, leading to widespread condemnation and urgent pa
Irrelevant; source discusses a different CVE (CVE-2026-73774) and HPE.
Irrelevant; source is a generic NIST NVD homepage.
Irrelevant; source discusses a different CVE (CVE-2026-73774) and HPE.
Irrelevant; source is a generic NVD search page.
Irrelevant; source is a generic BreachHQ homepage.
Broadcom support portal highlights critical vulnerabilities in VMware products, reflecting ongoing security concerns but not directly addressing CVE-2019-3773.
"VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)"
NVD highlights the critical nature of the XXE flaw in Spring Web Services, emphasizing the severe risk of untrusted data exploitation.
"Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources."
Vulnpedia provides neutral, factual indexing of CVEs without specific vendor sentiment.
Daily Security Review reports a separate Broadcom supply chain breach, reflecting broader trust issues but not directly tied to CVE-2019-3773.
"Broadcom employee data leaked after a ransomware attack on ADP partner Business Systems House. Sensitive files appeared on the dark web, impacting global semiconductor workers."
Recent Breaches provides neutral breach tracking without vendor-specific sentiment.
CVE Find offers neutral vulnerability intelligence without vendor sentiment.
XposedOrNot provides neutral breach directory data without vendor sentiment.
Neutral; source only restates the NVD fact without commentary.
"Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources."
FEDRAMP CATALOG PRODUCTS · 4
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| Clarity | Authorized | Moderate |
| General Support Systems (GSS) | Authorized | Moderate |
| Rally | Authorized | Moderate |
| Symantec Gov Cloud Security (GCS) | In Process | Moderate |
Open questions: How has Broadcom addressed these vulnerabilities? · What is the company's current security posture? · Are there any ongoing or future security concerns related to Broadcom's products?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-25 03:43:11.556298+00:00