How can I download critical security patches without a support contract

[James Hawkins]

Hello,

I do a lot of work with Cisco collaborations systems that run on Cisco UCS servers and use VMware ESXi to host virtual machines.

Most of these system were bought as a hardware, hypervisor and software bundle and included a perpetual license for ESXi 7.0 Foundation. Pre-Broadcom Cisco had an arrangement with VMware to provide patches as part of the Cisco support contract.

This has been cancelled by Broadcom and I now have a number of customers whose systems need patching to address critical vulnerabilities.

The Broadcom article at the link below says that these patches should be available.

Zero Day (i.e., Critical) Security Patches for vSphere (7.x and 8.x) Perpetual License Customers with Expired Support Contracts

Broadcom		remove preview
Zero Day (i.e., Critical) Security Patches for vSphere (7.x and 8.x) Perpetual License Customers with Expired Support Contracts that all customers, including those with expired support contracts, will have access to all patches for Critical Severity Security Alerts for supported versions of VMware vSphere. Supported versions of VMware vSphere are versions 7.x and 8.x. View this on Broadcom >

My problem is that I cannot work out how I can access the patch I need (VMware-ESXi-7.0U3w-24784741-depot.zip).

When I login to the VMware portal I cannot see the download as available.

Is there a way that I can request access to it?

Thanks for reading!

James

[andrewckloh]

i'm sorry that Avango only know making money.

[CMS201110141]

I don't know if Broadcom makes the critical updates generally available in the support portal or only if there is a matching (expired) perpetual license associated with the account...

Have you tried to first log in to the support portal then open the release notes for the ESXi-7.0U3w patch (https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-70u3w-release-notes.html) and then follow the direkt link to "this patch" in the "Patch Download and Installation section"?

Regards,

  Carl

[Alexandru Capras]

I believe you can download patches with an expired contract as long as you have perpetual licenses for versions 7.x or 8.x.
You'll also need a registered account and most likely a Site ID or token.
That said, you can try what Carl mentioned, sometimes I just go straight to the patch download link from the release notes instead of going through the whole support portal.

[James Hawkins]

Thanks Carl and Alexandru for replying.

I have tried accessing the release notes as suggested but the download link was not active.

As the software was supplied through Cisco I do not believe that there were direct support contracts with VMware.

I am going to ask Cisco support about this.

Thanks again for your help.

[Johannes Sjoekvist]

I struggled with the same, and found that I can go to the free downloads section to get the patches (even thow the latest is not there?) for our perpetual license. But I have the site id and licenses linked to the account. So not sure if thats needed. ProductDownloads - Support Portal - Broadcom support portal

[Alexandru Capras]

Hi @James Hawkings, just wanted to follow up on your situation. Did you get any help or updates from Cisco?
Have you also considered opening a case with Broadcom to get their official stance on the zero-day vulnerabilities for customers with perpetual licenses?

[James Hawkins]

Hi, I raised a case with Cisco TAC and was immediately told that they were unable to help. I asked for my query to be passed to the product management team for the BE6000 product which the licenses were bundled with and that was refused too.

I was told to contact my Cisco account manager but we no longer have one after Cisco's staff cull last year. There will be hundreds of other Cisco customers with the same issue so I am far from impressed.

[Alexandru Capras]

Honestly, might be worth opening a case directly with Broadcom. Even without support, they should give at least a formal reply.
At minimum, it puts some pressure and creates a bit of noise... especially if more people do the same.

[Martin33]

I have already tried support tickets, however, without satisfying results.

The Register reported about similar experiences https://www.theregister.com/2025/07/23/vmware_patch_download_problems/ but Broadcom still does not provide a solution.

[HostaHost]

They won't give you a token if you have no active VCF/vsphere contracts.  You can register on the portal, but on the My Downloads page you will not see anything but a link to "free downloads".  On that page, go into Solutions tab and you can download ESXi 7.0U3s, but not the latest w.  They do not seem to be making that available.

[andrewckloh]

No, not at all.

I wanted to share a personal update regarding VMware products. I've been a strong advocate for them in the past, based on their excellent quality and reliability. I even recommended our company invest in their solutions.
However, since the transition to Broadcom, my experience has drastically changed. It feels as though customer relationships have taken a back seat to revenue, and essential access is now limited unless additional payments are made. I find this approach disappointing and misaligned with the standards I value.
Unless there are truly no alternatives, I won't be supporting or using their products going forward

[Martin33]

Hi,

I've the very same challenge. I opened a support ticket and was told that holders of perpetual licenses without valid support contact have to wait 90 days until they can download critical security updates. Actually, this is completely unacceptable and contradicts statements from Broadcom CEO. I asked the support agent to escalate this to management, however, I am in doubt that this happened.

If you have any idea how to escalate this issue and remind Broadcom of their CEO's statement about secure use of perpetual licenses, would be highly appreciated. Contact press might be another option.

[Peter K]

Same topic here.  I have perpetual licenses for version 8 hypervisor and vcenter. also i was able to create a download-token. But all downloads , updates etc. for this security update failed because I'm not entitled.  I had some chat with the support and pointed also to the KB article. I got only the answer  that the patch will be available for customer without contract on a later date. The date could not be defined. Then i was forced to renew my contracts to get updates. 

[Martin33]

Meanwhile I've shared my experience with The Register (https://www.theregister.com/2024/04/16/broadcom_vmware_perpetual_license_support/). They will ask Broadcom for a statement. Let's see…

[Matthew Wilson]

Im having this arguement with broadcom as we speak.  They told me this:  "our support portal requires validation of customer entitlements for software patches, only entitled customers have access to the patches at this time. A separate patch delivery cycle will be available for non-entitled customers and will follow at a later date."

I asked where in the public domain does it say they and i was told it isnt. It's on their internal systems.  I repeatedly sent them the link https://knowledge.broadcom.com/external/article/314603/zero-day-ie-critical-security-patches-fo.html stating that we're a customer with a perpetual license, support expired 2 weeks ago but we want to install the latest patch for v7 (w) as is addresses several cvss 9.3 critical issues.   Going in circles, managed to get a ticket open, to which they instantly closed parroting the above.  I've asked for it to be kept open and to escalate.

-------------------------------------------

[Andy Turner]

I'm in the same boat.  I've been tearing my hair out for hours trying to figure this out before I came across this thread. 

The idea that critical security patches would be intentionally withheld is absolutely absurd to me.

-------------------------------------------

[Peter Roddan]

Hi There,

Has anyone made any progress on this? I'm in the same situation, perpetual licences, expired support, and am trying to download the patch which KB 314603 says I should be entitled to.

Thanks,

Peter.

-------------------------------------------

[Peter Roddan]

(Apologies for the double post, it looks like there must have been some human approval needed for these, I  had assumed I'd not posted the first reply correctly)

Has anyone with perpetual licenses / no support contract made any progress here?

I am in the same boat as many of you, having had support tickets closed instantly with no positive results.

 

-------------------------------------------

[g0rbi]

try google... there are some FTP download sources out there...

[Peter Roddan]

Thanks for the suggestion - actually obtaining the patch isn't an issue, but we won't install that without some form of approval from Broadcom.

-------------------------------------------

[g0rbi]

You may be able to compare the Checksums from official source to others?!

MyOp.: What they've done to perpetual customers is a mess.

[Peter Roddan]

Thanks for the suggestion.

I could compare the checksum to a file from another source, but we won't install the patch unless we're explicitly told we can do so by Broadcom, or are able to download from an official source.

More of a company issue than a technical one.

Thanks,

Peter

-------------------------------------------

[andrewckloh]

Regrettably, I was under the impression that this s'pore crop's bidding depends on whether further payment is made.  Honestly, I feel disappointed-I've really lost respect for this group of companies."

-------------------------------------------

[Peter Roddan]

Well, it finally looks like we can get this patch.

VMware-ESXi-7.0U3w-24784741-depot.zip is now available to download in the Free Downloads section of the Broadcom Support site, you just need to register. Looks like this was added on 14/10.

My Downoads / Free Software Downloads available HERE / VMware Vsphere / Solutions / Vmware Vsphere Standard / 7.0

Glad they made it easy to find!

-------------------------------------------

[Matthew Wilson]

Excellent, I had given up. Thanks for alerting us.

-------------------------------------------

[Martin33]

Apparently, things start over for VMSA-2026-0006.

Same situation: Patch ESXi-8.0U3k has been published but is not (yet) available for download. I assume the "90 days delay policy" is still in place.

Has anyone heard any news from Broadcom support or others whether there was (or should have been) any change in this respect?

Thanks!

[Nathan Watts]

This is the article you are referring to, it has the details in there.
Article 314603

To access the updates: 

Customers can continue to apply patches through existing product patching mechanisms, including the VMware Support Portal, and after May 6, 2024, by registering or using their existing registration for  support.broadcom.com.

[Martin33]

Nathan,

Thank you for sharing the article.

I am aware of this statement from Broadcom, however, reality has proven that the previous patch for a critical vulnerability was available on customer support portal only after 90 days. While this very bad practice, it seems that Broadcom still applies this policy.

Can you confirm this?

Or can you provide us with better news?

[Nathan Watts]

This has not been my experience, but all things being equal, they most likely are not equal :)

I'll need to ask.

[LordLeonidas]

Same here. No patch made available in my portal.

However, if one can have critical patching occurring within the 90 days delay period you basically can "flip the finger" to non-paying or ex-customers till kingdom comes.

Of course, a 90 days delay for a critical patch is in my opinion Broadcom's way of forcing you to upgrade or leave yourself unprotected, but I am guessing that is not Broadcom's concern. The mighty dollar is.

Broadcom is more than free to help me adjust my view of the current state of affairs but since I have been in chats with Broadcom I got answers by them to have a look at the portal for downloads this and that and of course the "cow droppings" reply of the 90 days delay.

Not holding my breath and neither should you.

[Nathan Watts]

Do you have a site ID attached to your account?

[LordLeonidas]

Site ID has been there since I got the license way back when...

Within my vCenter portal itself I can see the patching but can't download it / provision the ESXi nodes nor update the vCenter Appliance

And like I wrote earlier the downloads itself (*.zip or ISO for that matter) are nowhere to be found in my Broadcom support portal.

Referring to the following:

• VMware-VCSA-all-8.0.3-25600417.iso
• VMware-vCenter-Server-Appliance-8.0.3.01000-25600417-updaterepo.zip
• VMware-vCenter-Server-Appliance-8.0.3.01000-25600417-patch-FP.iso
  
  

Same for the ESXi nodes ofcourse.

[Derek Kirk]

CVE-2026-59310 is under active exploitation and the patch to fix this vulnerability is still not available to perpetual license holders without a support contract.

Beyond ridiculous from Broadcom.

[LordLeonidas]

Advocate of the devil reply:
Intendent to force expensive upgrade on ex-costumers?

Frankly in a world where AI is finding exploits faster than I can pronounce "Beelzebub is the Lord of Flies" 400 times 1 exploit might be found.
https://en.wikipedia.org/wiki/Beelzebub

This policy of 90 days might as well be a discussion for a Senate oversight commission hearing (U.S. Senate Committee on Commerce, Science, & Transportation)?

U.S. Senate Committee on Commerce, Science, & Transportation		remove preview
U.S. Senate Committee on Commerce, Science, & Transportation U.S. Senate Committee on Commerce, Science, & Transportation View this on U.S. Senate Committee on Commerce, Science, & Transportation >

Or the ENISA (European Union Agency for Cybersecurity) I would guess...