Broadcom's Balancing Act: Security Breach, a Looming Debt Wall, and the AI Bet That Ties Them Together

Broadcom faces dual pressures: an exploited VMware vulnerability and massive off-balance-sheet AI financing, with shares down 6% in a week.

There are moments when a company's contradictions surface all at once. For Broadcom, that moment arrived in a single trading week that laid bare the two forces now pulling at its share price: a security vulnerability actively exploited in the wild, and a financial architecture for its AI ambitions so vast it could reshape how investors measure risk.

The immediate trigger for the market's unease came from an unexpected corner — not the chip business, but the software portfolio Broadcom acquired when it took over VMware. Hackers have been actively exploiting a critical vulnerability in VMware vCenter, tracked as CVE-2026-59310, with a near-maximum CVSS severity score of 9.8. Security researchers have confirmed intrusions across 361 IP addresses spanning 47 countries, with activity concentrated in Germany, the United States, Turkey, Iran, and France. The attackers deployed tools including reverse_ssh and web shells to establish persistent access — and did so just five days after a patch was released in late July.

The market's response was swift. The stock shed roughly 6 percent on Friday alone, closing at $392.99 against the prior session's $417.82. That fed into a weekly decline that reached 6.4 percent before stabilizing; by the following session, shares had recovered to €342.45, up 1.0 percent on the day. The secondary article notes a slightly different weekly figure of 6.2 percent, but both point to the same pattern: a sharp, news-driven correction rather than a fundamental repricing.

The Balance Sheet Story Behind the Headlines

Yet the security breach, serious as it is, may not be the more consequential story. Buried in Broadcom's latest quarterly filing is a commitment that has analysts reaching for their calculators. The company has agreed to guarantee up to $29 billion in lease payments for an investor partner that purchased racks equipped with Broadcom's custom AI accelerators.

Bank of America analyst Tom Curcuruto estimated on August 14 that a third-party financing vehicle supporting Broadcom's AI chip expansion could see its senior debt balloon to $370 billion by mid-2029 — including $150 billion in new issuance in 2027 alone. The secondary source frames this slightly differently, citing Bank of America's warning that off-balance-sheet obligations from the AI-XPV platform could reach $42 billion by 2029, tied to a projected debt pile of $370 billion for building out 20 gigawatts of computing capacity.

Whatever the precise mechanics, the picture is clear: Broadcom is not merely designing chips. It is simultaneously constructing the financing infrastructure that will carry the AI boom — a web of leases, bonds, and partnerships whose risks will only fully reveal themselves over time. Media reports also point to a strategic partnership with Samsung to develop custom ASIC chips, reportedly worth hundreds of billions of dollars in lifetime value — another brick in the same wall.

Analysts Hold Their Ground

Despite the twin pressures, the sell-side has largely maintained its conviction. On August 14, several houses raised their price targets. BNP Exane lifted its target to $675 from $640, reaffirming an Outperform rating on the strength of the XPU business — Broadcom's line of AI accelerators. Arete Research followed with an increase to $530 from $488, also maintaining a buy recommendation. Jefferies confirmed its Buy stance after reviewing the financing structure.

The broader consensus remains firmly bullish: "Strong Buy" with 23 buy ratings against four holds, and an average price target around $512.87.

Institutional Crosscurrents

The institutional picture, however, is more nuanced. Second-quarter 13F filings show hedge funds run by Daniel Loeb and Stanley Druckenmiller exited their Broadcom positions entirely, rotating into Taiwan Semiconductor, which has gained roughly 41 percent since the start of the year. Druckenmiller's Duquesne had only entered Broadcom in the first quarter of 2026 before selling out completely in the second — a move that looks more like short-term rotation than durable skepticism.

Offsetting those exits, Appaloosa under David Tepper added to its position, and director Harry L. You purchased 1,000 shares at $373.57. The insider buying and fresh institutional accumulation suggest the selling is not universal.

The Regulatory and Product Front

Broadcom's regulatory exposure is also growing. On August 3, the EU dismissed a Broadcom lawsuit that sought to block the transfer of US legal documents to the European Commission — a side skirmish, but one that underscores how closely regulators are now watching the company.

On the product side, Broadcom has announced new vDefend and Avi Load Balancer features designed to provide layered protection for VMware cloud environments — a direct response to the security debate that has dominated recent headlines.

What the Numbers Actually Say

Strip away the noise, and the underlying business remains formidable. AI semiconductor revenue jumped 143 percent in the second quarter to $10.8 billion, and the company says its AI product backlog exceeds $30 billion. The infrastructure software segment, which includes VMware, contributed $7.2 billion in quarterly revenue. The semiconductor business alone is running at roughly $15 billion per quarter.

The stock's current position tells a story of its own. At €343.10, it sits about 20 percent below its 52-week high of $429.60, yet remains 42 percent above its August 2025 low. On a monthly basis, the shares are still up 5.5 percent — evidence, perhaps, that the market is weighing short-term headlines more heavily than the medium-term growth trajectory.

The Test Ahead

The real examination comes on September 2, when Broadcom reports fiscal third-quarter results. Automated estimates project annual earnings growth of 33.7 percent and revenue growth of 30.5 percent over the next three years — figures that will be measured against the growing liabilities on the company's books.

The VMware vulnerability is a genuine reputational issue, and the debt concerns deserve serious attention. But neither changes the structural demand for AI infrastructure that is driving Broadcom's core business. The question is whether the operating momentum can outrun the financing risks — and whether investors can distinguish between the symptom and the substance.