CERT-FR Advisory Flags VMware Tanzu Platform Bugs
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory lists multiple unspecified-severity vulnerabilities across VMware Tanzu Platform components and bundled third-party software; patches are available.
CERT-FR has published a security advisory (CERTFR-2026-AVI-1385) covering multiple vulnerabilities in various VMware/Broadcom Tanzu Platform components, including API Gateway, Platform Services, Service Publisher, Tanzu Hub, Tanzu GemFire, Tanzu for Postgres, Tanzu Kubernetes Grid Integrated Edition Management Console, Ruby and Staticfile Buildpacks, and several Ubuntu/Windows stemcell images. The vendor has not specified the exact nature of the risk (listed only as 'non spécifié par l'éditeur'), suggesting the bulletin largely aggregates fixes for vulnerabilities in bundled third-party components (OS packages, libraries, runtimes) shipped inside these stemcells and buildpacks rather than a single newly disclosed flaw in VMware's own code.
The advisory references over 40 separate Broadcom security bulletins and an extremely large number of CVE identifiers, spanning from very old issues (dating back to 2002) through to 2023, indicating this is primarily a bulk update addressing historical third-party component vulnerabilities carried in base images and buildpacks rather than a set of newly weaponized issues. No evidence of active exploitation is mentioned, and CERT-FR provides no additional technical detail beyond pointing to the vendor bulletins.
Defenders running affected Tanzu Platform components should update to the fixed versions listed by CERT-FR (e.g., API Gateway ≥2.4.10, Platform Services ≥10.4.6/11.0.0, Tanzu Hub ≥10.4.6/11.0.0, TKGI Mgmt Console ≥1.26.3, and updated stemcells) per the referenced Broadcom security advisories. Given the lack of severity rating from the vendor and absence of reported in-the-wild exploitation, this should be treated as routine patch management rather than an urgent incident.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1385
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs