VMSA-2025-0013: VMware Workstation 17.6.4 and Fusion 13.6.4 released

[Daniel Casota]

Folks,

Update your Workstation/Fusion installation due to VMSA-2025-0013.

VMSA-2025-0013
- Support Content Notification - Support Portal - Broadcom support portal
- vcf-security-and-compliance-guidelines/security-advisories/vmsa-2025-0013 at main · vmware/vcf-security-and-compliance-guidelines

Workstation 17.6.4 ProductFiles - Support Portal - Broadcom support portal

Fusion 13.6.4 ProductFiles - Support Portal - Broadcom support portal

VMware Tools 13.0.1 ProductFiles - Support Portal - Broadcom support portal
VMware Tools 12.5.3 ProductFiles - Support Portal - Broadcom support portal

It started in May 2025
Trend Zero Day Initiative auf X: „Oh my! In a #Pwn2Own first, Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG was able to go from guest to host on #VMware ESXi. Amazing work. He's off to the disclosure room to provide the details. #P2OBerlin https://t.co/HLCbVfD9eY“ / X

[jrussel]

New release, same update logic?

It feels surreal to me, for lack of a better word. Months ago, access to the update server was disabled, and at least for me the subdomain doesn't resolve these days.

At least Workstation 17.6.4 (I don't know about Fusion) still attempts to do the same when checking for updates, the lack of attention to detail is worrying.

[Technogeezer]

Don't blame the Fusion or Workstation teams for the removal of in-product updates. They are collateral damage from Broadcom's corporate decision to limit in-product updates to customers holding active support entitlements (a.k.a. subscriptions). From what I've heard, the desktop hypervisor teams didn't have a say in the decision - it was forced on them as unauthenticated (anonymous public) download servers were decommissioned with no replacement. . 

I doubt that in-product update features are going to return unless Broadcom has a serious change in attitude about this -- or comes up with a pseudo-entitlement for those registered users that are downloading their free products. I would hope that they could come up with some way to perform in-product notification of new updates. 

I have found (at least for Fusion 13.6.4) that the error message has changed when trying to "check for updates". Instead of saying "the update server could not be resolved", it now says "Unable to connect for updates at this moment". The new message provides a link to a Broadcom KB article that documents the change in the in-product update policy. The message is still misleading - it should come right out and say "In-product updates are no longer available" along with the link to the KB article. That is, of course, unless they are using this a placeholder for some kind of in-product update notification that isn't quite ready for release yet (yes, and I believe in unicorns and rainbows and pixie dust as well).

------------------------------
- Paul (technogeezer)
vExpert 2025
------------------------------

[jrussel]

I don't blame them for the removal, but they are responsible for how the products ship.

When Workstation 17.6.3 and Fusion 13.6.3 released, it hadn't been long since the decision was made so they could be excused, but we are now several months afterwards and the next version was still released with the same broken updater; hence my remark on the lack of attention to detail, it should have been removed or replace with something else.

Other features were removed in recent versions even when they were in a functional state, for example.

[Daniel Casota]

I would love to see a new strategy for Workstation+Fusion WF. WF is cybersecurity auditor's preferred tool, around the globe.

Some ideas.

1. Make users pay for it again.
2. virtual Hardware v23++
   MCP-servers must be integrated at virtual hardware level. Users often don't know anymore which virtual hardware generation to choose best for Centos, Windows XP or Windows 2025. Consulting static docs is decoupled today from cybersecurity and that's not good. Let's ask the virtual hardware about its capabilities. If no host GPU present, failback to static docs is okay.
3. OS
   Where is Broadcom's MCP server for all sort of OS? W11 integration was nice, but the workflow is static. ISO selection outside MCP workflows started fading out. Who thinks in the age of AI that in 10 years people still know from which dns url they need to download which ISO or tool? They ask their AI for that.
4. Cybersecurity Profiles
   Working with Ubuntu, Kali Linux, ParrotOS, etc. means using OSINT tools like Burp, Maltego, etc. They need API keys. WF today supports TPM 2.0 v1.59. Please, store those API keys inside a WF key store. VMware Tools can leverage key store functionality.
5. Audits
   Auditor's reports is key for software architects+developers. If they need them with the complete OS log bundle for replay purposes e.g. in Purview, allow that MCP connector. But please, WF bundle logs functionality for auditors to train other AIs is not free.
6. What you see is what you get
   WF + MCP plugins + Key store +  memorized Actions must become an intrinsic part of VCF Blockchain DevSecOps.

Strategy first. WF must become highly valuable again and people will pay for.

[James Lin]

It is not from a lack of attention to detail.

We were going to completely rip out the software update notification mechanism in VMware Workstation 17.6.4 and Fusion 13.6.4.  However, we are still investigating possible ways to bring update notifications back in a way that would be both acceptable for current Broadcom policies and that would be compatible with existing product installations. 

We then were left with two choices:

A. Completely remove the update notification system, rendering Workstation 17.6.4 and Fusion 13.6.4 never able to receive update notifications on the chance that they eventually could be restored.

B. Leave the existing update notification system in place but try to make the error messages clearer.

Note that we could not leave the update notification system in place but hidden; products silently checking for updates without explicit user permission would be a privacy problem.

For Workstation 17.6.4 and Fusion 13.6.4, we chose option B.  After we've completely exhausted all chances of restoring update notifications for existing products, then yes, we will just remove or replace it.

[kasper]

Thank you for the post.   Once again it was a bear to download.   The download process is a moving target and my aim is not what it used to be.  I really would like to see the tools update and workstation update one and the same.   That is, if the tools software changes they should just come up with a new workstation update.   The tools update makes the end user guiena pigs.