
Internal Broadcom communications, according to The Register report, show support staff acknowledging that “recent changes to our support portal, related to entitlement checking, will cause delay in making patches available to customers with expired entitlements.”
Recent security advisories have warned of critical vulnerabilities affecting ESXi, Workstation, and Fusion. These flaws enable attackers with administrative privileges on virtual machines to execute code on host systems.
Earlier this year, VMware disclosed vulnerabilities that were actively exploited in the wild, including CVE-2025-22224 and CVE-2025-22225. CISA added these to its Known Exploited Vulnerabilities catalog.
“In an era where delayed remediation can lead to breach exposure or compliance failure, the right to patch must be decoupled from subscription status,” Gogia explained. He added that CISOs must now treat patch access as a board-level assurance issue.
Enterprise customers face subscription pressure
The security patch issue reflects broader challenges since Broadcom’s acquisition. The company eliminated perpetual licenses in favor of subscription-only pricing, with many customers reporting significant cost increases.
“In this new landscape, licensing must be treated as a live operational dependency, not a closed financial transaction,” Gogia explained.