# VMware virtualization flaws in Rockwell Automation Lifecycle Services

Published: 2025-07-31 · Severity: routine · Sectors: manufacturing, energy, government-national, defense, infrastructure
Canonical: https://vorant.io/reports/dc6eecd8-03fe-5a49-9f6b-f1b16a927b44/vmware-virtualization-flaws-in-rockwell-automation-lifecycle-services

> Four critical VMware virtualization vulnerabilities in Rockwell Automation Lifecycle Services enable host code execution; no active exploitation reported.

CISA published a Rockwell Automation security advisory detailing four vulnerabilities in Lifecycle Services appliances built on VMware platforms, affecting Industrial Data Center (IDC), VersaVirtual Appliance (VVA), Threat Detection Managed Services (TDMS), Endpoint Protection Service, and Engineered and Integrated Solutions—across all or multiple generations. Three out-of-bounds write vulnerabilities affect VMware's VMXNET3 network adapter, VMCI (Virtual Machine Communication Interface), and PVSCSI (Paravirtualized SCSI) controller, each permitting code execution on the ESXi host with CVSS 9.4 (v4). A fourth vulnerability in vSockets leaks uninitialized memory from processes, scoring 8.2 (v4). All require local access and exploit hypervisor components; remote exploitation is not possible. Rockwell will contact affected managed-service customers; those unmanaged should refer to Broadcom's VMware patch advisories for ESXi 7.0 and 8.0 releases. No known exploitation in the wild has been reported. Organizations should apply patches from Broadcom, minimize network exposure of ICS assets, and isolate control systems behind firewalls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dc6eecd8-03fe-5a49-9f6b-f1b16a927b44/vmware-virtualization-flaws-in-rockwell-automation-lifecycle-services.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup