Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · EDR and XDR · in CISA KEV

Broadcom in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 6 entries for Broadcom as of catalog version 2026.11.06, released November 6, 2026. The newest was added October 28, 2026, and the latest federal due date is November 11, 2026. CISA marks 1 of them as known ransomware use.

Updated

entries in the catalog
6
newest addition
October 28, 2026
latest federal due date
November 11, 2026
marked known ransomware use
1

Directory record

Website
www.broadcom.com
Categories
EDR and XDR (primary), Email security, Data loss prevention
Headquarters
San Jose, United States
Founded
Not established
Ownership
Public (NASDAQ: AVGO)
Company record
Broadcom on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Broadcom”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added October 28, 2026

    CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability

    VMware ESX · on must-patch

    Due November 11, 2026

  2. Added August 18, 2026

    CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability

    VMware vCenter · known ransomware use

    Due August 21, 2026

  3. Added March 3, 2026

    CVE-2026-22719 Broadcom VMware Aria Operations Command Injection Vulnerability

    VMware Aria Operations

    Due March 24, 2026

  4. Added January 23, 2026

    CVE-2024-37079 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

    VMware vCenter Server

    Due February 13, 2026

  5. Added October 30, 2025

    CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability

    VMware Aria Operations and VMware Tools

    Due November 20, 2025

  6. Added April 28, 2025

    CVE-2025-1976 Broadcom Brocade Fabric OS Code Injection Vulnerability

    Brocade Fabric OS

    Due May 19, 2025

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Daily briefing · October 31, 2026

    Chinese actors chained VMware ESX and Linux zero-days to root firewalls

  2. Daily briefing · October 30, 2026

    Chinese Actors Exploit VMware ESX Zero-Day and Chain Flaws to Root Firewalls

  3. Daily briefing · October 29, 2026

    CISA adds VMware ESX and Linux Kernel flaws to exploited-vulnerability catalog

  4. Weekly archive · Mar 2 – Mar 8, 2026

    CISA Flags Qualcomm and Broadcom VMware Flaws as Exploited

  5. Weekly archive · Oct 27 – Nov 2, 2025

    XWiki and VMware Aria Flaws Added to CISA's Exploited Vulnerabilities Catalog

  6. Weekly archive · Apr 28 – May 4, 2025

    CISA Flags Three More Actively Exploited Vulnerabilities

  7. Weekly archive · Oct 21 – Oct 27, 2024

    Broadcom Re-Patches Critical VMware vCenter RCE Flaw

  8. Weekly archive · May 23 – May 29, 2022

    Broadcom agrees to acquire VMware for $61 billion

  9. Weekly archive · Feb 28 – Mar 6, 2022

    Broadcom's Symantec Unit Disclosed Daxin Backdoor Used in Espionage Campaign

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Broadcom, published November 8, 2026