VMware Cloud Foundation 9.0.1.0 landed on 29 September 2025, and if you’re running a production VCF 9.0 environment, this one is not optional. There’s a security advisory in the mix, and the vCenter fixes alone are worth the upgrade window.
I’ve been tracking this release since the advisory dropped. Here’s what actually matters.
The Security Fix — CVE-2025-41250
VMSA-2025-0016 covers CVE-2025-41250, rated at CVSSv3 6.8. The vulnerability is a blind SQL injection in the VMware Aria Automation API. An authenticated user with low privileges could potentially extract database content through crafted API requests. Not a remote code execution, but still worth treating as urgent if you run Aria Automation in a multi-tenant or shared environment.
The fix is included in VCF 9.0.1.0 as part of the SDDC Manager bundle update. No manual patching needed if you go through LCM.
vCenter Fixes — More Than 30 of Them
This is the part of the release notes I spent the most time reading. vCenter 9.0.1.0 addresses over 30 bugs that shipped with the initial 9.0 release. I’ve pulled out the ones most likely to affect a typical VCF lab or production setup.
VM and guest operations — vCenter was failing to correctly report guest OS customization status in some cases, leading to false errors after Windows sysprep. That’s fixed. There was also a problem where VM snapshot consolidation would hang if the VM had a large number of snapshots with delta disks; the timeout handling is now more reliable.
Permissions and roles — A bug where custom roles lost their propagation settings after a vCenter restart has been corrected. If you had role assignments behaving strangely after maintenance reboots, this is likely the culprit.
Storage and datastores — There were cases where vSAN datastore capacity was being misreported in the vSphere Client after a node failure and recovery. The cluster summary page would show stale capacity numbers until a manual refresh. This is now handled automatically.
vSphere HA and DRS — A corner case where HA would not restart VMs after a host isolation event if the isolation response was set to “leave powered on” has been resolved. Also, DRS was generating migration recommendations for VMs already pinned to hosts by VM-Host affinity rules in some cluster configurations. That one caused a lot of unnecessary noise in environments with strict placement policies.
Networking — Distributed port group configuration changes were occasionally not being pushed to hosts within the expected time window, causing brief inconsistencies in port group settings across the cluster. The synchronisation mechanism has been tightened up.
UI and API — Several REST API endpoints that returned incorrect pagination metadata have been corrected. If you were building automation against the vCenter REST API and getting odd page counts, this is worth testing after the upgrade.
Aria Operations 8.18.5
Aria Operations and Aria Operations for Logs both updated to version 8.18.5 in this release cycle (also released 29 September 2025). The updates are primarily stability fixes — improved alert suppression logic during maintenance windows, and a fix for the vSAN capacity trend widget that was occasionally showing negative projected capacity when a cluster had recently had nodes removed.
If you deploy Aria Operations through LCM as part of your VCF stack, these updates will be included in the 9.0.1.0 bundle automatically.
Bill of Materials — VCF 9.0.1.0
Here’s the full component list for this release. Cross-check your environment against these builds before and after the upgrade to confirm everything landed correctly.
| Component | Version | Build |
|---|---|---|
| VMware Cloud Foundation | 9.0.1.0 | 25018966 |
| ESXi | 9.0.1.0 | 24820808 |
| vCenter Server | 9.0.1.0 | 24820826 |
| NSX | 9.0.1.0 | 24825884 |
| SDDC Manager | 9.0.1.0 | 24837099 |
| Aria Suite Lifecycle | 8.18.1 | 24737827 |
| Aria Operations | 8.18.5 | 24963462 |
| Aria Operations for Logs | 8.18.5 | 24943523 |
| Aria Automation Orchestrator | 8.18.1 | 24737827 |
| VMware Tools | 13.0.8 | 24555027 |
| VMware Remote Console | 13.0.1 | 24470466 |
| VMware Live Recovery | 9.0.3 | 24773987 |
How to Get It
The update is available through SDDC Manager’s LCM workflow. Download bundles from the Broadcom Support Portal under VMware Cloud Foundation > 9.0.x. The bundle download takes a while — SDDC Manager itself, ESXi, vCenter, and NSX are all separate downloads before LCM will show the upgrade as available.
If you’re running a lab environment without internet access on the management network, you’ll need to do an offline bundle import. The process is the same as 9.0, just with the 9.0.1.0 manifest and bundle files.
Plan for a maintenance window of at least 3–4 hours for a standard 4-node management domain. vCenter restarts twice during the process, and NSX has its own rolling upgrade that adds time depending on host count.
Worth Doing Now
Given the security advisory, I’d put this one in the “upgrade this month” bucket rather than waiting for your next quarterly maintenance cycle. The SQL injection in Aria Automation is the main driver, but the sheer number of vCenter fixes also makes this a quality-of-life release. Thirty-plus bugs in the initial 9.0 drop is a fair few, and several of them touch things like HA restart behaviour and DRS recommendations that you really want working correctly.
I’ll post a full walkthrough of the 9.0.1.0 LCM upgrade process separately. The release notes from Broadcom are linked below if you want to go through the full list yourself.
VMware Cloud Foundation 9.0.1.0 Release Notes — Broadcom TechDocs