In a tersely worded blog post, Iain Mulholland, director of VMware's Security Response Center, said the posted ESX code and associated commentary was created between 2003 and 2004.
Mulholland did not provide additional details on the leaked code but said the fact that it has been made public does not necessarily put VMware customers at risk.
Given the large number of service providers that run vSphere, security issues in ESX could potentially have a broad and widespread impact, according to security researchers.
"A serious zero day to the hypervisor could be disastrous to a lot of customers," said Andrew Plato, president of Anitian Enterprise Security, a Beaverton, Ore.-based security solution provider.
Chris Ward, vice president of consulting and integration at Greenpages, a Kittery, Maine-based solution provider, said the potential risks -- to VMware and its customers -- depend on what type of ESX code has been compromised.
"If the code leaked was more service console level, versus the hypervisor or virtual machine manager (VMM) level code, then this is probably no big deal," Ward said. "However, if the code contains some of the more proprietary stuff, then it is a potential security risk -- as well as a competitive risk if someone like Oracle, Red Hat, or Microsoft can capitalize on it."
VMware says it is looking into the matter and will be canvassing its industry partners and developers in order to determine the source of the breach.
"VMware proactively shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today," Mulholland said in the blog post. "We take customer security seriously and have engaged internal and external resources, including our VMware Security Response Center, to thoroughly investigate."
The ESX hypervisor has helped VMware take a dominant position in the server virtualization market. In 2008, VMware introduced a smaller, streamlined version of ESX -- called ESXi -- which is embedded in server motherboards.
VMware began using ESXi as its primary hypervisor in vSphere 5, in which it enables key features such as automatic deployment of hosts.
related stories
Video
trending stories
sponsored resources

OutSystems
Modern Application Development 360

Symantec
Symantec Business Security Learning Center

HP Amplify™ - A Simplified Global Program for the Customer-Driven Digital Age
HP Inc.

BlackBerry
BlackBerry Learning Center

Dell Technologies
Dell Technologies Cloud Learning Center

Dell Technologies
Dell Technologies Storage Learning Center

NPD
Industry Trends 360

Products of the Year Showcase

Cysurance
Cyber Insurance 360

StorageCraft
Disaster Recovery Learning Center

APC by Schneider Electric
IoT Platforms 360

EPOS
EPOS

Smart 3rd Party
3rd Party Maintenance 360

WatchGuard
WatchGuard

Spectrum Partner Program
Spectrum Partner Program

ADT
Network Security 360

Tenable
Cyber Risk 360

Dell Technologies
Dell Technologies Hybrid Cloud Learning Center

Wasabi
Wasabi

Webroot
Webroot Learning Center

Dell Technologies
Dell Technologies Server Learning Center

HubStor
Cloud Backup 360
