# VMware Tanzu and Spring products patched for multiple vulnerabilities

Published: 2026-10-02 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/a5bc2463-a484-5721-afd4-08833c502c68/vmware-tanzu-and-spring-products-patched-for-multiple-vulnerabilities

> VMware issued patches for multiple security vulnerabilities affecting Tanzu Kubernetes, Spring Cloud, and Valkey products released October 2026.

CERT-FR published a security advisory documenting multiple vulnerabilities across VMware's Tanzu and Spring product lines, issued 1 October 2026. The affected products include Spring Cloud Data Flow for Kubernetes (versions before 1.6.16), Spring Cloud Gateway for Kubernetes (before 2.2.17), VMware Tanzu for Postgres on Kubernetes (before 4.5.2), and VMware Tanzu for Valkey across multiple version branches (8.0.x, 8.1.x, 9.0.x, 9.1.x). The advisory indicates these vulnerabilities permit attackers to provoke unspecified security issues, though precise attack vectors and impacts are not detailed in the source material. VMware released eight security bulletins (39108-39115) coordinated with patches available through Broadcom support channels.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40897, CVE-2023-5752, CVE-2024-2236, CVE-2024-45336, CVE-2024-45337, CVE-2024-45341, CVE-2024-6345, CVE-2025-11065, CVE-2025-15366, CVE-2025-15367, CVE-2025-22866, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870, CVE-2025-22871, CVE-2025-22872, CVE-2025-22873, CVE-2025-22874, CVE-2025-46686, CVE-2025-4673, CVE-2025-4674, CVE-2025-47273, CVE-2025-47906, CVE-2025-47907, CVE-2025-47912, CVE-2025-47914, CVE-2025-48924, CVE-2025-5278, CVE-2025-58181, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-6141, CVE-2025-6170, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1249

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a5bc2463-a484-5721-afd4-08833c502c68/vmware-tanzu-and-spring-products-patched-for-multiple-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup