Broadcom’s licensing overhaul drives enterprises from VMware to open source Proxmox, but rushed migrations and poor patching habits are creating fresh security risks.
A growing number of enterprises are shifting from VMware to Proxmox, an open-source hypervisor, following Broadcom’s pricing and licensing changes that have left organisations facing “big bills.” The move signals a broader enterprise pivot toward community-driven, cost-effective infrastructure as an alternative to proprietary virtualisation systems.
Unlike VMware, Proxmox is free and open source, with optional paid tiers for technical support, reliable updates, and enhanced security. Other open-source hypervisors, including XCP-ng, are also attracting attention for their VMware-like architecture and management tools.
However, a new warning from the exposure management platform runZero reveals that many Proxmox deployments are outdated or end-of-life (EoL), leaving systems exposed to critical vulnerabilities. “Most installations are running stale versions,” runZero reported, identifying Proxmox 8.0.3 to 8.4.13 as the most common, while versions prior to 8 are no longer supported.
“Importantly, the entire operating system no longer receives security updates, not just the Proxmox VE software. This means that every new vulnerability in Debian may also impact these older versions, including supporting services like OpenSSH,” — runZero
The firm warned that “only a small minority of users are keeping up with patches,” making outdated systems “many times more numerous than supported ones.”
Proxmox releases follow the Debian Linux schedule, with three-year major version support. “Proxmox VE 8… is supported until June 2026,” runZero noted.
