# CERT-FR Advisory Flags VMware Tanzu Platform Bugs

Published: 2026-10-26 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/d4e06b8e-b5e3-569d-8424-6b63e84ff941/cert-fr-advisory-flags-vmware-tanzu-platform-bugs

> CERT-FR advisory lists multiple unspecified-severity vulnerabilities across VMware Tanzu Platform components and bundled third-party software; patches are available.

CERT-FR has published a security advisory (CERTFR-2026-AVI-1385) covering multiple vulnerabilities in various VMware/Broadcom Tanzu Platform components, including API Gateway, Platform Services, Service Publisher, Tanzu Hub, Tanzu GemFire, Tanzu for Postgres, Tanzu Kubernetes Grid Integrated Edition Management Console, Ruby and Staticfile Buildpacks, and several Ubuntu/Windows stemcell images. The vendor has not specified the exact nature of the risk (listed only as 'non spécifié par l'éditeur'), suggesting the bulletin largely aggregates fixes for vulnerabilities in bundled third-party components (OS packages, libraries, runtimes) shipped inside these stemcells and buildpacks rather than a single newly disclosed flaw in VMware's own code.

The advisory references over 40 separate Broadcom security bulletins and an extremely large number of CVE identifiers, spanning from very old issues (dating back to 2002) through to 2023, indicating this is primarily a bulk update addressing historical third-party component vulnerabilities carried in base images and buildpacks rather than a set of newly weaponized issues. No evidence of active exploitation is mentioned, and CERT-FR provides no additional technical detail beyond pointing to the vendor bulletins.

Defenders running affected Tanzu Platform components should update to the fixed versions listed by CERT-FR (e.g., API Gateway ≥2.4.10, Platform Services ≥10.4.6/11.0.0, Tanzu Hub ≥10.4.6/11.0.0, TKGI Mgmt Console ≥1.26.3, and updated stemcells) per the referenced Broadcom security advisories. Given the lack of severity rating from the vendor and absence of reported in-the-wild exploitation, this should be treated as routine patch management rather than an urgent incident.

## Mentioned in this report

- Vulnerabilities: CVE-2022-0529, CVE-2022-0530, CVE-2022-1210, CVE-2022-1304, CVE-2022-1587, CVE-2022-2056, CVE-2022-2057, CVE-2022-2058, CVE-2022-2309, CVE-2022-24407, CVE-2022-2519, CVE-2022-2520, CVE-2022-2521, CVE-2022-26280, CVE-2022-26488, CVE-2022-27774, CVE-2022-27776, CVE-2022-27943, CVE-2022-2953, CVE-2022-29824, CVE-2022-3114, CVE-2022-3162, CVE-2022-3172, CVE-2022-3219, CVE-2022-32205, CVE-2022-32206, CVE-2022-32208, CVE-2022-3294, CVE-2022-33070, CVE-2022-34903, CVE-2022-35252, CVE-2022-3570, CVE-2022-3597, CVE-2022-3598, CVE-2022-3599, CVE-2022-3626, CVE-2022-3627, CVE-2022-3715, CVE-2022-37454, CVE-2022-39046

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1385

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d4e06b8e-b5e3-569d-8424-6b63e84ff941/cert-fr-advisory-flags-vmware-tanzu-platform-bugs.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup