Support Content Notification - Support Portal

Product Release Advisory - Application Services for VMware Tanzu Platform 3.3.14

Product/Component

Tanzu Kubernetes Runtime

7 more products

Notification Id

37035

Last Updated

24 February 2026

Initial Publication Date

24 February 2026

Status

CLOSED

Severity

HIGH

CVSS Base Score

7.8

WorkAround

N/A

Affected CVE

See CVE list in advisory

Product Release Advisory - Application Services for VMware Tanzu Platform 3.3.14

	Highest Score CVE from list below advisory details
Severity	High
CVSS V4 Vector	Unavailable
CVSS V4 Score	Unavailable (Sev: Unavailable)
CVSS V3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS V3.1 Score	7.8 (Sev: HIGH)
CVSS V2 Vector	Unavailable
CVSS V2 Score	Unavailable (Sev: Unavailable)

Note: if cvss scores are "Unavailable" it is most likely due to the vulnerability being GHSA or BDSA without a matching CVE for nvd lookup.

Product Version Release Advisory

Security Fixes: This release has the following security fixes, listed by component.

Component	Vulnerabilities Resolved
backup-and-restore-sdk	CVE-2025-61729 (High) CVE-2025-61727 (Medium) CVE-2025-12818 (Medium) CVE-2025-12817 (Low)
bpm	CVE-2025-61731 (High) CVE-2025-61726 (High) CVE-2025-68119 (High) CVE-2025-61728 (Medium) CVE-2025-61730 (Medium)
pxc	CVE-2025-61731 (High) CVE-2025-61729 (High) CVE-2025-61726 (High) CVE-2025-68119 (High) CVE-2025-61728 (Medium) CVE-2025-61727 (Medium) CVE-2025-61730 (Medium)
spring-cloud-services	CVE-2026-21945 (High) CVE-2026-21932 (High) CVE-2025-67735 - GHSA-84h7-rjj3-6jx4 (Medium) CVE-2026-21933 (Medium) CVE-2026-21925 (Medium) CVE-2026-1225 - GHSA-qqpg-mvqg-649v (Low)