Multiple vulnerabilities in VMware Tanzu products fixed by Broadcom bulletins of 6 November 2026
Broadcom published bulletins 39514 to 39551 and DSA-2026-24 on 6 November 2026 for VMware Tanzu products, and the CERT-FR notice CERTFR-2026-AVI-1486 relays them on 9 November. The notice lists 35 product and branch lines, including Tanzu GemFire, Tanzu Greenplum, Tanzu RabbitMQ, Tanzu for Postgres and Spring Cloud Gateway for Kubernetes, each with its first fixed version. It says the flaws let an attacker cause a security problem that the vendor does not specify, so the impact, the affected component and the prerequisites are not stated. It gives no CVSS score, no attack vector and no sign of exploitation, and it lists 123 CVE identifiers without tying them to a specific product. Urgency is medium because the technical risk is unclear, but the patch volume is large, so defenders should check the Broadcom bulletins for exposed versions. The web research did not reach the November 2026 Broadcom bulletins themselves, so the fixed versions above are those given in the CERT-FR notice.
Entenda a falha
A vulnerabilidade
Broadcom published bulletins 39514 to 39551 and DSA-2026-24 on 6 November 2026 for VMware Tanzu products. CERT-FR relayed them on 9 November in notice CERTFR-2026-AVI-1486, which lists 123 CVE identifiers without tying them to a product. The vendor does not specify the impact, the component, the prerequisites or the CVSS score, only that an attacker can cause an unspecified security problem. Affected versions include Spring Cloud Gateway for Kubernetes < 2.3.0, Tanzu Application Platform < 1.12.8, Tanzu for Postgres for Kubernetes < 4.6.0, Tanzu for MySQL for Kubernetes < 2.0.6 and several GemFire, Greenplum and RabbitMQ lines. The first fixed version of each line is the one in the notice.
Como funciona
The articles do not describe how any of these flaws work. The CERT-FR notice only says that an attacker can cause an unspecified security problem, so the input, the vulnerable component and the step where it fails are unknown. Defenders need the individual Broadcom bulletins for the mechanism of each CVE.
Por que é vulnerável
The root cause is not stated. The notice does not say whether the flaws are missing checks, memory errors or something else, nor why they went unnoticed. The fix is to upgrade to the fixed versions listed by the vendor, and the articles do not say what each fix changes.
Como foi descoberta
The articles do not say who found the flaws or how. They only say that Broadcom disclosed them in security bulletins on 6 November 2026 and that CERT-FR relayed them on 9 November. The notice gives no sign of exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:32.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2019-9193. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PostgreSQL 9.3 - COPY FROM PROGRAM Command Execution (Metasploit)
This Metasploit module abuses the COPY FROM PROGRAM feature of PostgreSQL 9.3 and later, tracked as CVE-2019-9193, which the PostgreSQL project disputes as documented behavior rather than a flaw. The attacker needs network access to the database port and valid credentials for a superuser or a role allowed to run server programs. The module creates a table, runs an operating system command through COPY, then drops the table, giving command execution as the database service account on Linux, macOS or Windows. It is a mature, working module, but only after authentication.
Linha do tempo
-
Multiple vulnerabilities in VMware Tanzu products fixed by Broadcom bulletins of 6 November 2026
ler a análise desta fonte ocultar
Broadcom published bulletins 39514 to 39551 and DSA-2026-24 on 6 November 2026 for VMware Tanzu products, and the CERT-FR notice CERTFR-2026-AVI-1486 relays them on 9 November. The notice lists 35 product and branch lines, including Tanzu GemFire, Tanzu Greenplum, Tanzu RabbitMQ, Tanzu for Postgres and Spring Cloud Gateway for Kubernetes, each with its first fixed version. It says the flaws let an attacker cause a security problem that the vendor does not specify, so the impact, the affected component and the prerequisites are not stated. It gives no CVSS score, no attack vector and no sign of exploitation, and it lists 123 CVE identifiers without tying them to a specific product. Urgency is medium because the technical risk is unclear, but the patch volume is large, so defenders should check the Broadcom bulletins for exposed versions. The web research did not reach the November 2026 Broadcom bulletins themselves, so the fixed versions above are those given in the CERT-FR notice.