Broadcom's Twin Headaches: An Exploited VMware Flaw and a $370 Billion Off-Balance-Sheet Shadow

Broadcom shares fell 6.5% as a critical VMware vulnerability is actively exploited and BofA flags $370B AI financing exposure by 2029.

The sell-off that hit Broadcom on Friday was swift and severe, but the forces behind it were anything but simple. The chipmaker's shares tumbled 6.5 percent to €339.05 in German trading, extending a weekly decline to 8.3 percent, as investors grappled with two distinct sources of anxiety: a security vulnerability now being actively weaponized in the wild, and a growing debate over the company's sprawling financial commitments to its AI infrastructure buildout.

On Wall Street, the stock closed at $392.99, down 5.9 percent on the day, having swung between a high of $412.50 and a low of $388.50 on volume of roughly 29.5 million shares. The move pushed the equity below its 50- and 100-day moving averages, though it still trades about 6.5 percent above the 200-day line. The broader market also retreated from record highs that session, with Applied Materials and Intel among the laggards — but Broadcom's decline was notably outsized.

The first trigger is a security crisis with real-world consequences. Security researchers have confirmed that attackers are actively exploiting a critical vulnerability in VMware vCenter, designated CVE-2026-59310. The flaw, which resides in the software's syslog server, allows unauthenticated remote code execution. Broadcom disclosed the issue in late July and rushed out an emergency patch, but that did not stop malicious actors from moving quickly. Compromised systems began contacting attacker-controlled infrastructure as early as August 3, and by August 7 researchers had identified 361 affected IP addresses spread across 47 countries. The attack pattern shows classic path-traversal activity followed by the installation of a malicious cron job, designed to maintain persistent access through reverse_ssh.

The second, and arguably more consequential, source of pressure is financial rather than technical. Bank of America downgraded Broadcom on August 14 from "Overweight" to "Marketweight," a decision driven not by operational concerns but by the intricate financing architecture underpinning the company's AI chip expansion. Analyst Tom Curcuruto flagged the XPV platform — a financing vehicle Broadcom built alongside Blackstone and Apollo to fund AI chip purchases — as the primary source of uncertainty.

The numbers attached to that platform are staggering. Curcuruto projects that by mid-2029, the vehicle could carry roughly $370 billion in debt at a capacity of 20 gigawatts, with as much as $150 billion in new debt issuance potentially hitting the market in 2027 alone. Broadcom has disclosed in its most recent quarterly report that an investor partner has taken over the underlying purchase and lease agreements, with Broadcom guaranteeing lease payments for five years and facing a maximum exposure of up to $29 billion from the original transaction.

This is where the two articles converge on a critical nuance. The $370 billion figure is not a current balance-sheet liability but a projection of what could materialize if a growing share of today's off-balance-sheet guarantees becomes actual payment obligations. The distinction matters. Broadcom's specific exposure today is the roughly $29 billion guarantee tied to the so-called Big Sky deal with Anthropic, a $35 billion debt package. Rating agencies are taking notice: S&P plans to treat such commitments as contingent debt going forward, while Moody's has warned about the accumulation of these risks across multiple transactions.

What makes the situation particularly delicate is that the downgrade arrived even as the bank's analysts grew more optimistic about the underlying business. Bank of America had raised its 2026 revenue forecasts by 10 percent and EBITDA expectations by 13 percent. The risk, in other words, is not in the operations — it is in the architecture.

The bull case rests on a formidable operational foundation. Broadcom's backlog stands at a record roughly $110 billion. In the second quarter of fiscal 2026, revenue grew 47.9 percent to $22.19 billion, with AI-related revenue alone surging 143 percent to $10.8 billion. Semiconductor revenue from AI applications rose by that same 143 percent in the quarter. As long as customers like Anthropic continue to service their obligations, the guarantees remain theoretical — a risk premium rather than a realized loss.

Yet the bear case carries its own logic. CreditSights warns that such structures are inherently "pro-cyclical," amplifying boom-bust dynamics — invisible during good times, suddenly real during downturns. There are already signs of institutional caution. Tiger Global has trimmed its Broadcom position, and even Nvidia is recalibrating its own exposure, reportedly considering cutting its guarantee for an OpenAI data center project from an original $250 billion to under $120 billion. That Nvidia is pulling back suggests the industry's largest players are becoming more conservative about risk concentration.

The technical picture adds another layer of complexity. Broadcom sits 21 percent below its 52-week high of €429.60, reached in early June, though the stock remains up 14 percent year-to-date. The monthly decline is a more modest 1.6 percent. The annualized 30-day volatility of 44 percent and an RSI of 45 both point to elevated nervousness among holders.

What Friday's sell-off ultimately represents is a repricing of uncertainty rather than a fundamental deterioration. The question hanging over the stock is whether that uncertainty resolves in Broadcom's favor — through continued AI demand and customer solvency — or whether the contingent liabilities start migrating from footnotes to the balance sheet. The coming quarters, and the rating agencies' treatment of these guarantees, will provide the answer.