# CERT-FR flags mass VMware Tanzu CVE bundle

Published: 2026-11-09 · Severity: high
Canonical: https://vorant.io/reports/22634dde-bb53-56da-af5c-2f7979b62260/cert-fr-flags-mass-vmware-tanzu-cve-bundle
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists numerous unpatched vulnerabilities across VMware Tanzu products including GemFire, RabbitMQ, Greenplum and Application Platform; patch per Broadcom bulletins.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1486

## What to check

- Applies to: The 39 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2025-1094 (weaponized); no exploitation in the wild is recorded.

CERT-FR published a consolidated advisory referencing over thirty Broadcom/VMware security bulletins (numbered 39514-39551 and DSA-2026-24) covering a very large number of CVEs across the VMware Tanzu product family. Affected components include Tanzu Application Platform, Tanzu Data Intelligence, Tanzu GemFire (multiple editions including Kubernetes, .NET client, Management Console, Session Management and Vector Database variants), Tanzu Greenplum (database, Command Center, Backup and Restore, Streaming Server, Text, Platform Extension Framework), Tanzu RabbitMQ (standalone and Kubernetes), Tanzu for MySQL/Postgres/Valkey for Kubernetes, Tanzu Data Flow for Kubernetes, and Spring Cloud Gateway for Kubernetes. Fixed versions are specified for each product line.

The advisory itself does not detail individual vulnerability mechanics or confirm in-the-wild exploitation; CERT-FR notes the risk level as 'unspecified by the vendor' and directs readers to the underlying Broadcom security bulletins for CVE-level detail and patches. The CVE list spans many years (from 2016 through late 2025/2026), indicating this is largely a consolidated dependency and third-party component remediation release (e.g., bundled OpenSSL, Jackson, libcurl, SQLite and similar library CVEs) rather than a set of newly discovered flaws unique to VMware code.

Defenders running any Tanzu-branded product should inventory their deployed versions against the minimum patched versions listed (e.g., Tanzu RabbitMQ < 3.13.21/4.1.17/4.2.12/4.3.7, Tanzu GemFire < 10.1.10/10.2.9/10.3.3, Tanzu Greenplum < 6.34.0/7.9.0, Tanzu Application Platform < 1.12.8) and apply updates per the referenced Broadcom advisories. Given the breadth of affected components and the age/mix of underlying CVEs, this should be treated as routine but broad patch management rather than an active-exploitation emergency, pending further detail from Broadcom's own advisories.

## Mentioned in this report

- Vulnerabilities: CVE-2022-4899, CVE-2023-4039, CVE-2024-41110, CVE-2024-45337, CVE-2024-45338, CVE-2024-47611, CVE-2025-0167, CVE-2025-1094 (weaponized), CVE-2025-21613, CVE-2025-21614, CVE-2025-22868, CVE-2025-22869, CVE-2025-27113, CVE-2025-27613, CVE-2025-30204, CVE-2025-32414, CVE-2025-32415, CVE-2025-3360, CVE-2025-46569, CVE-2025-47906, CVE-2025-47907, CVE-2025-48924, CVE-2025-49506, CVE-2025-53547, CVE-2025-54388, CVE-2025-55198, CVE-2025-55199, CVE-2025-58181, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-58190, CVE-2025-6297, CVE-2025-6395, CVE-2025-64329, CVE-2025-66034

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1486

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/22634dde-bb53-56da-af5c-2f7979b62260/cert-fr-flags-mass-vmware-tanzu-cve-bundle.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup