vSphere 8 End of Support Is Oct. 11, 2027: 10 Exploited Flaws Already Hit 8.0

vSphere 8 end of support is October 11, 2027: Broadcom’s KB 459135 sets that end of general support date for ESXi 8.x, vCenter Server 8.x and vSAN 8.x. As of Nov 12, 2026 that is 333 days away. After it, Broadcom’s KB 456708 says there will be “no Technical Support and no new patches.” 10 of the 19 ESXi and vCenter flaws in CISA’s exploited catalog already affect 8.0.

Key findings

• Broadcom dates vSphere 8.0 general availability to Oct 11, 2022 and end of general support to Oct 11, 2027, exactly five years. vSphere 7.0 got 2,009 days after a six-month extension; 8.0 gets 1,826.
• KB 456708, published Oct 15, 2026, puts 13 VMware product lines on the same Oct 11, 2027 end of service date, including NSX 4.x, VCF 5.2.x, HCX 4.x and Aria 8.18.x.
• Since vSphere 7 left general support on Oct 2, 2025, VMware’s CNA has published 5 ESX or vCenter CVEs. All 5 list 8.0 and 9.x as affected; none mentions 7.0 at all, fixed or unfixed.
• 3 ESXi or vCenter flaws joined CISA’s Known Exploited Vulnerabilities catalog after that date. Two of them (CVE-2026-59310 and CVE-2026-41709) come from that post-cutoff advisory, so a 7.0 owner has no Broadcom statement on exposure.
• Of 13 ESXi/vCenter KEV entries added after the catalog’s launch batch, the median gap from disclosure to confirmed exploitation was 64 days, and 3 took more than a year (up to 841 days).
• 14 of 19 exploited ESXi/vCenter flaws affect 7.0 and 10 affect 8.0. 8 of the 19 are flagged by CISA as used in ransomware campaigns.

vSphere 8 end of support date: ESXi 8, vCenter 8 and vSAN 8

Broadcom states the dates in two knowledge base articles. KB 459135 (last modified Oct 27, 2026) is the vSphere 8 notice; KB 456708 is the wider end of service list. Both give the same day for every vSphere 8 component, so there is no separate vCenter 8 or ESXi 8 end of support date to track. KB 459135 covers ESXi 8.x and vCenter 8.x as a whole, so 8.0 Update 1, Update 2 and Update 3 builds all share the October 11, 2027 date.

Blue: general support. Light blue: Technical Guidance. Red dots: dates CISA added an ESXi or vCenter flaw affecting that version to KEV (hover for the CVE). vSphere 9 is shown from GA only.

What end of general support means in Broadcom’s terms

Broadcom uses three phrases, and they are not interchangeable. Its maintenance policy handbook says that at end of service it will no longer “provide operational or technical support” or “develop and provide new enhancements, features, upgrades, service packs, and fixes.” KB 456708 states it plainly for the 8.x line: after the date, “no Technical Support and no new patches.”

Technical Guidance is the phase that confuses most readers. For vSphere 7, VMware’s July 25, 2024 extension post listed an End of Technical Guidance date of Apr 2, 2027 with a footnote: “Does not apply to Broadcom contracts. Applicable to valid VMware contracts only.” That window has 141 days left. For vSphere 8, neither KB 459135 nor KB 456708 gives a Technical Guidance date. Trackers such as endoflife.date list October 11, 2029, citing Broadcom’s product lifecycle portal, which requires a Broadcom login and did not return its lifecycle table to our script. Treat 2029 as unconfirmed, and remember that KB 456708’s wording rules out new patches either way.

Extended support: Broadcom’s vSphere 7 reminder told customers to contact their Broadcom representative or reseller about “the availability of Extended Support.” No Broadcom page we fetched publishes a price or term for vSphere 8 extended support, so we do not quote one.

Why the date matters: what happened to vSphere 7 after October 2, 2025

vSphere 7 gives a 13-month preview of life after the 8.0 cutoff. We pulled every ESXi and vCenter CVE in NIST’s National Vulnerability Database (226 records) and each one’s CVE record from CVE.org, then matched them to CISA’s KEV catalog (version 2026.11.10).

Since Oct 2, 2025, VMware’s CNA has published 5 new ESX or vCenter CVEs. All come from one Broadcom advisory dated July 30, 2026, and every record lists 9.1, 9.0 and 8.0 as affected, with fixes such as ESXi80U3k-25595708 for hosts and 8.0 U3k for vCenter. None of the 5 names 7.0, so the records say neither that 7.0 is affected nor that it is safe. Two of those five are now exploited: CISA added CVE-2026-59310 (vCenter, flagged for ransomware use) on August 18, 2026 and CVE-2026-41709 (ESX) on October 28, 2026. That is the situation 8.0 hosts face after Oct 11, 2027. Fortinet followed a similar pattern after FortiOS 7.0 end of life, shipping two more builds (7.0.18 and 7.0.19) after its September 30, 2025 end of support and none since January 30, 2026.

The third post-cutoff KEV addition shows the other side. CVE-2024-37079, a vCenter flaw disclosed June 18, 2024, was added to KEV on January 23, 2026, 584 days later. Its CVE record lists a 7.0 fix (7.0 U3r), shipped while 7.0 was still supported. Owners who had patched before the cutoff were covered; those who had not could still download the fix. Flaws disclosed inside a support window keep their patches. Flaws disclosed after it do not get one.

Across all 19 exploited ESXi and vCenter entries, exploitation often lands long after disclosure. Our comparison of hypervisor CVEs with CISA’s exploited list covers why attackers concentrate on VMware; here the question is timing. CVE-2022-22948 took 841 days and CVE-2021-21973 took 376. A flaw disclosed in vSphere 8’s final months can be confirmed exploited well after Oct 11, 2027, but Broadcom’s fix will exist only if the disclosure came first.

Days from NVD publication to CISA KEV addition. Grey: the 6 entries in KEV’s launch batch of Nov 3, 2021, which back-filled older exploitation and overstate the gap. Red: more than 365 days.

ESXi and vCenter CVEs by major version and year

We assigned each CVE to every major version that NVD’s CPE data or the CNA’s affected list names. 8.0 has 41 CVEs so far, against 97 for 7.0 and 85 for 6.7. 7.0 and 8.0 shared almost every flaw from 2023 to 2025: in 2024 both had 15 and in 2025 both had 13. The split appears only in 2026, when the 7.0 column drops to zero because the 2026 records no longer name 7.0.

CVEs published per year listing each version (KEV entries in brackets). *2026 to Nov 12, 2026. A CVE can count under several versions. 6.0 is left out of the grid but counted in All. 61 older records (mostly pre-2016, ESX 3.x to 5.x) carry no 6.0+ version and are excluded from the grid.

Every exploited ESXi and vCenter flaw, newest first

Filter by the version you run. CISA’s catalog is the U.S. government’s list of flaws with confirmed exploitation; our analysis of 2026 KEV additions covers the full catalog.

* KEV launch batch. Versions from NVD CPE configurations and the CNA’s CVE record; 6.0 to 9.x only. Ransomware: CISA’s knownRansomwareCampaignUse field.

vSphere 8 upgrade and migration planning: days remaining

Broadcom’s handbook says it aims to give at least 12 months’ notice of an end of service date; KB 456708 carries a Oct 15, 2026 date stamp, just under 12 months before the cutoff. Counting back from Oct 11, 2027:

• Jan 14, 2027 (63 days left): Inventory: ESXi and vCenter builds, plus host hardware checked against the Broadcom Compatibility Guide that KB 390293 points to
• Apr 14, 2027 (153 days left): Decide: VCF 9 / VVF 9 upgrade, migration, or accept risk with a documented exception
• Jul 13, 2027 (243 days left): Upgrade vCenter first, then hosts, per KB 390293
• Oct 11, 2027 (333 days left): End of general support: no new patches for 8.x

What this means for MSPs

• Set the deadline as the last patch, not the last day. The latest 8.0 fixes named in the CVE records we pulled are ESXi80U3k and vCenter 8.0 U3k. Any host left on 8.0 after Oct 11, 2027 is frozen at whatever build ships before then.
• Upgrade order is fixed. KB 390293 says vCenter must be upgraded before ESXi hosts, so the vCenter change window comes first in every client plan.
• The rest of the stack moves too. NSX 4.x, HCX 4.x, VCF 5.2.x and Aria 8.18.x share the same date, so a client cannot keep 8.0 hosts under a supported NSX or HCX.
• Price the change from the quote, not from articles. Broadcom publishes no public price for vSphere 8 extended support or for VCF 9 per core on the pages we checked; get it in writing from the reseller.
• Write the exception. For any host that will miss the date, record it as out of support, isolate the management interfaces, and track KEV for ESX and vCenter entries. Many of the same clients face Microsoft deadlines in the same window, listed in our Windows Server end of life dates tracker.

FAQ

When does vSphere 8 support end?

Broadcom’s KB 459135 gives October 11, 2027 as the end of general support for ESXi 8.x, vCenter Server 8.x and vSAN 8.x, five years after their October 11, 2022 general availability. As of Nov 12, 2026 that is 333 days away.

What does end of general support mean for vSphere 8?

Broadcom’s KB 456708 says that after the October 11, 2027 date ‘there will be no Technical Support and no new patches’ for ESXi 8.x and vCenter 8.x. Its maintenance handbook says previously published fixes stay downloadable for the rest of your paid maintenance term.

Is there Technical Guidance or extended support after October 11, 2027?

No Broadcom page we could fetch gives a Technical Guidance date for vSphere 8. Trackers list October 11, 2029, citing Broadcom’s login-gated lifecycle portal. For vSphere 7, Technical Guidance ran to April 2, 2027 for VMware contracts only, and Broadcom told customers to ask their representative about Extended Support.

Is ESXi 9 released?

Yes. ESX 9.0 shipped in VMware Cloud Foundation 9.0, which Broadcom’s release notes date June 17, 2025 (build 24755599). Broadcom’s KB 456708 recommends VCF 9 or VVF 9 as the move from vSphere 8.

When did vSphere 7 support end?

October 2, 2025, after Broadcom extended it six months from April 2, 2025 (KB 415405). Since then 5 ESX or vCenter CVEs have been published by VMware’s CNA; none lists 7.0 as affected or fixed, and 2 of them are already in CISA’s KEV catalog.

How many exploited vulnerabilities affect ESXi 8 and vCenter 8?

10 of the 19 ESXi and vCenter entries in CISA’s KEV catalog (version 2026.11.10) list 8.0 as an affected version in NVD or the CVE record, including the two added in 2026: CVE-2026-59310 on August 18 and CVE-2026-41709 on October 28.

Free to cite and republish with a link. The CSV has one row per ESXi or vCenter CVE (226 rows) with affected major versions, KEV dates and ransomware flags.

References

1. Broadcom KB 459135, End of General Support for vSphere 8.0. Accessed November 2026.
2. Broadcom KB 456708, Upcoming End of Service for vSphere 8, vSAN 8, Aria 8, NSX 4 and VCF 5. Accessed November 2026.
3. Broadcom KB 415405, End of General Support for vSphere 7.0. Accessed November 2026.
4. Broadcom KB 390293, ESXi install and upgrade procedures. Accessed November 2026.
5. VMware Cloud Foundation blog, extension of vSphere 7.x general support (Jul 25, 2024). Accessed November 2026.
6. VMware Cloud Foundation blog, reminder: vSphere 7 end of service Oct 2, 2025 (Mar 31, 2025). Accessed November 2026.
7. Broadcom Software Maintenance Policy Handbook (July 2020). Accessed November 2026.
8. Broadcom, VMware Cloud Foundation 9.0 release notes. Accessed November 2026.
9. Broadcom security advisory 38017 (Jul 30, 2026), as referenced in the CVE records. Accessed November 2026.
10. NIST National Vulnerability Database, CVE API 2.0. Accessed November 2026.
11. CVE.org CVE Services API records (example: CVE-2026-59310). Accessed November 2026.
12. CISA Known Exploited Vulnerabilities catalog (JSON feed). Accessed November 2026.
13. endoflife.date, VMware ESXi (secondary, for the unconfirmed 2029 date only). Accessed November 2026.