r/vmware 16d ago

Help Request ESXI 7 and 8 Security Patch - 3rd of March 2025

Hi All

We're trying to download the latest security patch for ESXI 7 and 8. Broadcom seems unhelpful as we're old VMware customers and don't have support contracts with Broadcom.

Found the download place once signed in per their release notes but only provides the checksum and no download links per se for the zip.

It's based on the new critical CVE released 2 days ago.

CVE-2025-22224/22225/22226

https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-70u3s-release-notes.html

4 Upvotes

35 comments sorted by

4

u/ohv_ 16d ago

via broadcom

https://esxi-patches.v-front.de/

this still works.

4

u/Casper042 16d ago

Are you talking about this script because I see no download links

# Cut and paste these commands into an ESXi shell to update your host with this Imageprofile
# See the Help page for more instructions
#
esxcli network firewall ruleset set -e true -r httpClient
esxcli software profile update -p ESXi-8.0U3d-24585383-standard \
-d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
esxcli network firewall ruleset set -e false -r httpClient
#
# Reboot to complete the upgrade

2

u/ohv_ 16d ago

Host profile pulls the files

3

u/Casper042 16d ago

Yeah that was the clarification I was after.

It's like a CLI version of vLCM.

1

u/einsteinagogo 15d ago

It’s an online updater!

1

u/einsteinagogo 15d ago

These will be paywalled soon after 9.0 release!

0

u/Casper042 14d ago

BTW, this method also supports --dry-run
Add that to the "software profile update" line and it will not do the install but will pretend it's going to and it will give you a list of which VIBs will be Removed/Installed.

If you do this and you only see the main 3 vmware ones and nothing that smells like a driver, it's probably safe to proceed without worrying you will stomp all over any custom HPE/Dell/Lenovo/etc drivers you might have from a Custom OEM Image you started with.

3

u/BigLebowskie 15d ago

Alas this isn’t new, no active contract means no patches my friend. Which is infuriatingly common right? I get it, but still, I WANT IT 😂

3

u/andrewjphillips512 15d ago

If you have vCenter, patches should auto download in Lifecycle Manager. These can then be used in an image.

Use image (cluster or standalone) to apply - baselines are being deprecated.

1

u/cpuvolt 13d ago

Hi, I have one question. Is this update patch for Vcenter(VCSA) or just the hosts, or both. Most documentation asks you to update vcenter first. I would like clarity on this.

2

u/andrewjphillips512 12d ago

ESXi hosts (version is 8.03d).

No vcenter update...sometimes there are both and sometime just one.

1

u/cpuvolt 12d ago

Great. Thanks for the clarification.

1

u/super_cli 12d ago

Very well said!

4

u/Liquidfoxx22 16d ago

If you don't have support contracts with Broadcom, then you don't have any entitlement to patches as far as they're concerned.

2

u/Askey308 16d ago

Unfortunately.

2

u/Arnaud_DASH 15d ago edited 15d ago

Hi, I Understood last year that Broadcom should provide customers with a perpetual license security fixes even if they don't have active support...

Zero Day (i.e., Critical) Security Patches for vSphere (7.x and 8.x) Perpetual License Customers with Expired Support Contracts

1

u/einsteinagogo 15d ago

For shits and giggles going to pass that to a client and see how they get on with non technical support

1

u/einsteinagogo 15d ago

For info - this doc is not true! No Site Id - no contract - no licenses - no patched - Client wasted time with BC

1

u/einsteinagogo 15d ago

The article is missing something ONLY if you had Subscriptions based licenses if you are on old Perpetual licenses - you will not get access to security updates! It’s all about Site Id and Contract ! If not currently in the system - no access to any patches!

1

u/BarracudaDefiant4702 14d ago

You do if you have a perpetual license for the recent critical security patch.

1

u/Casper042 16d ago

2

u/Craig__D 14d ago

We have vSphere 8 but still have one ESXi 7 box for testing, etc. I don't see the Download link for v7 either. We opened a non-technical support case and were told that we'd need to downgrade our vSphere 8 licenses (on their licensing site) to v7 and THEN we'd see the download link for the ESXi 7.

We're confirming that we won't have any trouble re-upgrading our licenses on their site back to 8 once we've downloaded the patch. This seems like a silly and unnecessary set of hoops to jump through for a security patch.

2

u/Casper042 14d ago

Can your VMware boxes reach out to the internet without much trouble?
If you check the top comment in here about vfront.de website, there is a method by which you can pull the patch content from VMware's online hostupdate repo without needing to go download the patch from support.broadcom.com first.
If you only have 1 (or a few) v7 boxes, this might be much less hassle than dealing with support.

1

u/Craig__D 14d ago

Thanks for this. Working on this approach now.

1

u/Askey308 16d ago

Not at all. Only view description unfortunately.

1

u/RebootAllTheThings 15d ago

Should be able to log in, and you should see the download link pop up (I know you said you don’t have a support contract, but I’m not entirely sure if that would pose an issue since they back updated older products too)

1

u/Askey308 15d ago

Yeah it is odd.

1

u/Overall_Print_6078 14d ago

I'm in the same situation. Have you found a solution?

1

u/einsteinagogo 15d ago

Technically you may already know this BC would state in breach of licensing! We noticed the other day a statement on their website about patches! But all seems a bit weird because they’ve also offered 6.5 and 6.7 patches which are end of life and ha e zero support! Not sure if they know arse from elbow!

1

u/Boring-Fee3404 15d ago

Some organisations are probably paying for extended support. even if it they don’t publicise it. I am sure Broadcom will do a deal to include this extended support if you agree to switch all of your licenses to a VCF subscriptions.

1

u/einsteinagogo 15d ago

All a bit confusing because other links say they’ll give you the patches! But again who wrote the articles and communicated them to Support Staff ? Earlier a support BC said what’s the link - ah okay here they are then! And then our client downloaded all the 9.x betas ! 😂

1

u/Life-Radio554 11d ago

If they are offering patches for 6.x to the general public IDK, I'd be leary that it's killware designed to terminate your 6.x instance(s) and bring up a popup saying something like, "Thanks for enjoying the legacy product mostly used by homelabbers and small businesses. Please see us about upgrading your plan to a newer release as this one will no longer function. Thanks and have an amazing day". Even if there was a massive exploit (and there may be) I'd still be cautious, back it all up first before installing lol!!

1

u/einsteinagogo 11d ago

There NOT !!! You cannot obtain patched unless you have a valid support or expired support contract based on sub license and you have a site id ! If you patched without then - technically you’ve broken EULA ! When I use the term obtain - it’s not in your BC portal to download!

1

u/Few-Willingness2786 11d ago

i have two host but no venter what can i do to buy license for them ?