KECyber Security Research Vulnerability discovery · coordination · disclosure

PUBLIC ADVISORY DATABASE

KECYBER-SA

Technical vulnerability records published by KECyber Security Research. Every advisory preserves researcher credit, vendor position, CVE state, demonstrated impact, and material limitations.

1Published records
KECYBER-SAStable namespace
UTCPublication timezone
KECYBER-SA-2026-001

Broadcom / VMware Cloud Foundation Operations

Unauthenticated first-boot provisioning permits administrative takeover

An unauthenticated network caller can claim administrative ownership of an unconfigured appliance by reaching first-boot provisioning before its intended owner.

High CVE: vendor declined Researcher: HACKZA