Update manager (lifecycle manager) is not updating

paprika-1977-12 · 2025-03-07T20:41:58.593Z

@PatrickFarrell I read your post and found this interesting

0 day virtual machine escape vulnerability in VMware. Patch immediately VMware

Several vulnerabilities were patched today in ESXi 7 and 8, the worst of which is a virtual machine escape rated a 9.3. CVE-2025-22224 (CVSS 9.3): A Time-of-Check Time-of-Use (TOCTOU) vulnerability in VMware ESXi and Workstation that can lead to an out-of-bounds write condition. An attacker with local administrative privileges on a virtual machine could exploit this issue to execute code as the virtual machine’s VMX process running on the host. https://support.broadcom.com/web/ecx/support-cont…

I checked all my vSphere 7 vCenter and EXSi 7 hosts that were patched as of end of 2024 and not a one shows newer updates available.

At this point I am making a comment on that, since a good half of these are still under valid support. Curious why the update manager isn’t.

Rod-IT · 2025-03-07T20:53:48.868Z

Your VCSA or ESXi hosts may not have internet access to check. Start with validating this.

If they do, regardless of whether they show updates or not, check your version against the latest build and apply the updates accordingly.

See here for more info
Having issues patching ESXi - Virtualization - Spiceworks Community

Rod-IT · 2025-03-07T20:58:49.745Z

Here is the manual patch code for yours

esxcli network firewall ruleset set -e true -r httpClient
esxcli software profile update -p ESXi-7.0U3s-24585291-standard \
-d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
esxcli network firewall ruleset set -e false -r httpClient

paprika-1977-12 · 2025-03-07T21:02:10.386Z

Manual update sounds like a plan. I get this error when trying to manually sync with the configured depots:

A general system error occurred. A depot is inaccessible or has invalid contents. Make sure an official depot source is used and verify connection to the depot.

I follow this and find that I am indeed connecting just fine.

knowledge.broadcom.com

Error: "A depot is inaccessible or has invalid contents" when attempting to...

Unable to sync or download updates in vCenter Lifecycle Manager. vSphere Client displays: A general system error occurred: A depot is inaccessible or has invali

Rod-IT · 2025-03-07T21:18:38.560Z

A reboot of your VCSA may clear any network related issues, but it seems the system is having difficulties confirming there are updates.

Be sure your VCSA is on the latest before you apply updates.

paprika-1977-12 · 2025-03-07T21:34:46.384Z

Luckily they have not released newer vCenter patches yet.

paprika-1977-12 · 2025-03-07T21:48:38.527Z

@Rod-IT I am going to mark your answer as the best one as it provides a very fast and effective workaround for what seems to me is yet another fail by Broadcom.

here are the vCenter versions for reader enjoyment

https://knowledge.broadcom.com/external/article/326316/vmware-vcenter-server-versions-and-build.html

and the ESXi version for same

knowledge.broadcom.com

Build numbers and versions of VMware ESXi/ESX

This article provides build numbers and versions of ESXi/ESX.

Rod-IT · 2025-05-09T16:38:33.797Z

Please be aware the instructions above will have changed, as Broadcom now require you to have a token to download updates, this includes through VCSA/vLCM.

No subscription, no updates

https://dl.broadcom.com/[Your_Download_Token]/PROD/COMP/ESX_HOST/main/vmw-depot-index.xml

See here for other info relating to cease and desist letters.

Oh Broadcom.... really! Virtualization

So previously a discussion was started about cease and desist letters. More people are reporting these and those who have perpetual licenses but have applied updates less than the critical CVSS 9.x ones are now also receiving letters. [Imgur] (2936) Broadcom’s VMware Takeover Just Hit a New Low.. - YouTube And before someone posts about needing an official source and not trusting YouTubers, there isn’t one, but do your own research. Broa…

PatrickFarrell · 2025-05-09T17:13:24.339Z

Rod has it correct. No update token no downloads.

VMware Cloud Foundation (VCF) Blog – 24 Mar 25

Important Update: Changes to How You Download VMware Software Binaries

Starting March 24, 2025, there will be an important change to how you download VMware software binaries (including updates/patches).

Est. reading time: 2 minutes

paprika-1977-12 · 2025-05-09T18:25:23.227Z

Rod-IT:

No subscription, no updates

can confirm that they are not kidding around on that

PatrickFarrell · 2025-05-09T20:16:36.961Z

And if you installed some, you will get a C&D to remove them and possibly an audit.