What Happened
The VMware ESXi vulnerability behind Google Cloud's GCP-2026-050 bulletin is critical, and two of the five CVEs are already on CISA's Known Exploited Vulnerabilities list. For an MSP, that means a client environment can be hit before you finish reading this. There are no known workarounds. Your move: patch when Broadcom's fixes land, monitor VMware Engine workloads for unusual activity, and make sure your backups are clean and restorable.
Google Cloud published the bulletin on July 29, 2026, for its VMware Engine service. The vulnerabilities are in VMware ESXi and vCenter, and they were privately reported to Broadcom. Google is applying patches supplied by Broadcom, and it recommends customers monitor their workloads for unusual activities until the patches are in place.
For an MSP, the cost of a compromised hypervisor goes beyond the immediate outage. You lose billable hours to emergency response, you may face contract penalties, and clients may leave after a breach. Clean backups and a tested recovery plan are the difference between a bad week and a business-ending event.
Timeline
- 2026-07-29: Google Cloud publishes security bulletin GCP-2026-050 for VMware Engine, citing critical vulnerabilities in VMware ESXi and vCenter from Broadcom advisory VMSA-2026-0006.
Who Is Affected
Any organization using VMware Engine on Google Cloud is affected if its deployments run VMware ESXi or vCenter. Until Google applies the patches supplied by Broadcom, these environments are exposed to the vulnerabilities in advisory VMSA-2026-0006.
MSPs with clients on VMware Engine should treat every managed deployment as at risk. After patching, VMware Engine deployments should be running vCenter and ESXi 8.0 U3k. Verify your clients are on that version once patches are applied.
If you manage multiple clients on VMware Engine, the blast radius is multiplied. A single compromised vCenter can expose every cluster it manages. Identify which clients run VMware Engine and confirm you have contact and patching plans for each.
Why Hypervisor Vulnerabilities Are High Stakes
A hypervisor is the foundation under every VM on a host. When it is compromised, an attacker can move between VMs, access management interfaces, and disable security controls. For an MSP, that means one vulnerability can affect multiple clients at once.
VMware ESXi and vCenter are common targets because they sit at the center of many data center environments. Patches are the only real fix, and the window between disclosure and exploitation is often short. In this case, CISA has added two of the CVEs to its Known Exploited Vulnerabilities list, which indicates active exploitation.
MSPs should assume that any exposed VMware Engine deployment is at risk. That means tightening access, watching for anomalies, and having a recovery path that does not depend on the compromised environment.
Technical Details: VMware ESXi Vulnerability
Broadcom advisory VMSA-2026-0006 lists five critical vulnerabilities affecting VMware ESXi and vCenter: CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, and CVE-2026-41709.
According to Google Cloud, the vulnerabilities were privately reported to Broadcom. There are no known workarounds. Google is applying patches supplied by Broadcom. Once patched, VMware Engine deployments should be running vCenter and ESXi 8.0 U3k.
What MSPs Should Do
Google Cloud is applying Broadcom's patches to VMware Engine. There are no known workarounds. Do these now.
- Apply any necessary updates as they become available. Watch Google Cloud announcements and patch your VMware Engine deployments promptly.
- Monitor workloads on VMware Engine for unusual activities. Look for unexpected logins, configuration changes, or data access.
- Confirm your backup and recovery posture. Make sure you have clean, restorable copies of critical VMs and test your recovery process.
- Review access controls and limit administrative access to vCenter and ESXi. Reduce exposure until patches are applied.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of your clients' virtual machines. If an environment is compromised, you can recover without paying a ransom or rebuilding from scratch.
EnterProtect recovery gets a client running again after an outage or attack. The faster you restore service, the less revenue you lose.
EnterProtect vulnerability scanning helps you maintain an inventory of exposed versions across your estate. That makes it easier to prioritize patching and reduce risk.
EnterProtect is built for MSPs that need to keep clients running. The backup and recovery products are designed to restore virtual machines quickly, and the vulnerability scanner gives you a view of your clients' exposure so you can plan patching with confidence.
Frequently Asked Questions
What Are the Critical VMware ESXi Vulnerabilities in GCP-2026-050?
Google Cloud's bulletin cites five CVEs from Broadcom advisory VMSA-2026-0006: CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, and CVE-2026-41709. They affect VMware ESXi and vCenter on VMware Engine. CISA has added two of them to its Known Exploited Vulnerabilities list, which means they are being exploited in the wild. The vulnerabilities were privately reported to Broadcom and have no known workarounds.
Is There a Workaround for These VMware ESXi Vulnerabilities?
No. According to Google Cloud, there are no known workarounds. Google is applying patches supplied by Broadcom, and until those patches are in place, you need to monitor workloads for unusual activity. Once patches are available, apply them as soon as possible. In the meantime, reduce exposure by limiting administrative access and ensuring backups are current.
How Do I Know If My VMware Engine Deployment Is Patched?
Once patches are applied, your VMware Engine deployments should be running vCenter and ESXi 8.0 U3k. Check the version on your deployments and verify with Google Cloud after the patches are applied. Until then, monitor for any changes in version or configuration. If you see unexpected changes, investigate immediately.
What Should I Do If I See Unusual Activity on VMware Engine?
Isolate the affected workload, preserve logs, and investigate. In general, have a response plan and clean backups ready. Contact Google Cloud support for guidance on the platform. Also review access logs for the vCenter and ESXi management interfaces to identify any unauthorized activity.
How Can I Protect Client Environments Before Patches Are Available?
Apply any updates as soon as they become available, monitor for unusual activity, and ensure you have clean, restorable backups. Review and limit administrative access to vCenter and ESXi in the meantime. In general, maintain a patching cadence and test your recovery process regularly. The faster you respond, the lower the cost to your clients and your business.
Sources
- GCP-2026-050 (Google Cloud Security Corrected)