Impact of CVE-2026-33343 and CVE-2026-33413" or "Security scanner alerts for etcd vulnerabilities.

Products

• VMware vSphere ESXi

Issue/Introduction

• Security scanners, such as Arctic Wolf, may flag High security vulnerability alerts on ESXi 8.0.3 hosts. These alerts typically refer to etcd multiple vulnerabilities, including GHSA-rfx7-8w68-q57q and GHSA-q8m4-xhhv-38mg.
• Affected CVEs: CVE-2026-33343, CVE-2026-33413, and CVE-2026-44283.

Environment

VMware vSphere ESXi 8.x

Cause

The etcd service is started by the clusterAgent on each ESXi host, which may expose vulnerabilities if not updated or disabled.

Resolution

Note: Engineering is working on a future release of 8.0.x. For further assistance Contact Support.

Workaround:

Take necessary snapshot/backup of the vCenter. See VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice

1. Upload the "dkvs-cleanup-4-1.py" script to the vCenter.

2. Run this command to simply enumerate the hosts running DKVS and their health.

   python3 dkvs-cleanup-4-1.py -d ignore -w skip -s norestart

3. Run this command to immediately disable DKVS, discover the hosts that are running it, and clean everything up.

   python3 dkvs-cleanup-4-1.py -d disable -w all-soft -s restart

Note: This will restart the vpxd service.

Additional Information

Fixed in release 9.1.0 and higher. See Download Broadcom products, patches and software for steps to download this release.