ESXi CLI Patching | Angry SysOps Field Runbook

01 // OWNERSHIP

Route before touching the host

WHO OWNS THIS LIFECYCLE?

The command can be valid while the change is still wrong. Pick the release and the system that owns desired state. The route below decides whether this runbook is an approved control path or an out-of-band drift event.

Target release

ESXi 8.x ESXi 7.x ESX 9.x

ESXi 7 lifecycle warning ESXi 7 reached End of General Support on 2 October 2025. Use this workflow only for an approved existing-build recovery, stabilization, or upgrade path. It is not a current long-term security patching strategy.

Lifecycle owner

Standalone Auto Deploy vLCM VCF Support-led

CLI route possible

Standalone ESXi 8.x: the Broadcom 7/8 offline-depot procedure applies when the bundle, hardware, OEM content, and rollback path are approved.

This is still a maintenance-window operation. A dry run validates the image transaction; it does not validate the rest of the environment.

Scope boundary: this exact command-line procedure is verified by Broadcom for ESXi 7.x and 8.x. It is not presented here as an authoritative VMware ESX 9 patch procedure.

02 // PRE-FLIGHT

Readiness gate

NO CHECKMARKS, NO CHANGE.

Gate status 0 / 9

Every item below closes a different failure path. The patch lab stays locked until the lifecycle route and all nine controls are accounted for.

Scope and entitlementTarget release, exact build, entitled download, and approved window confirmed.

Special deployment exclusionThis is not a stateless Auto Deploy host, where configuration backup/restore is not applicable, or a Distributed Services Engine host using DPUs, where configuration backup/restore is unsupported. If either applies, stop and use the authoritative image/deployment workflow.

CompatibilityHardware, OEM add-on, firmware, drivers, NSX, vSAN, and interoperability reviewed.

Workload evacuationvMotion blockers, pinned VMs, passthrough, DRS mode, and console access accounted for.

Configuration backupConfiguration synchronized, bundle downloaded, and restore constraints validated.

Payload integrityOffline depot SHA-256 matches the Broadcom or OEM published value.

Recovery pathBootbank rollback limitations and reinstall/config-restore path are understood.

Maintenance policyStorage access and any vSAN data-migration policy are explicit and capacity-aware.

Evidence destinationBefore/after state, command output, checksum, approvals, and outcome have an owner.

Complete 9 controls to unlock.

03 // PATCH LAB

Guided command simulation

RUN THE WINDOW BEFORE THE WINDOW.

Configure a representative host, walk the ten phases, and inject a failure into the dry run. The command sequence mirrors the verified ESXi 7/8 offline-depot path.

Host variables

Host Datastore name or UUID Offline bundle

Exact image profile Profile namesIn VMware original depots, standard includes VMware Tools image updates; no-tools does not. An s before the patch letter identifies a security-only image. Verify the release notes; custom and OEM bundles can differ.

Host storage Dry-run fault injection

angrysysops.com // simulated shell Phase 01 / 10

Capture current state

[sim] Pre-flight gate is locked. Commands are visible; execution is disabled.

0 / 10 complete

04 // FIELD NOTES

What fires at each boundary

THE CONTROLLED WORKFLOW.

The shell is the easy part. The real job is preserving lifecycle ownership, proving what changed, and refusing shortcuts when the image transaction exposes a problem.

01 // CAPTURE

Freeze the before-state

Record version, build, image profile, acceptance level, and the installed component and VIB inventories. Components expose modern image and OEM/vendor state that a VIB-only comparison can obscure.

Acceptance level matters: it controls which signed content the host will accept. A signature error is a stop signal, not an invitation to bypass validation.

What breaks first

Without a before-state, an unexpected driver, OEM component, or profile suffix becomes guesswork after reboot.

ESXi Shell

vmware -vl
esxcli system version get
esxcli software profile get
esxcli software acceptance get
esxcli software component list
esxcli software vib list

02 // BACK UP

Make recovery real

Synchronize configuration to persistent storage, create the bundle, then actually download and validate it. A URL printed to the shell is not a completed backup.

Restore normally requires the same build and UUID. TPM-encrypted configuration from ESXi 7.0 U2 onward has hardware and TPM constraints. Treat config restore as a reinstall/recovery path, not instant rollback.

Deployment exclusion: this backup/restore path is not applicable to Auto Deploy hosts and is unsupported for Distributed Services Engine hosts using DPUs.

What breaks first

A stale or undownloaded bundle creates false confidence. Confirm the file exists off-host and that the documented restore constraints match the recovery target.

ESXi Shell

vim-cmd hostsvc/firmware/sync_config
vim-cmd hostsvc/firmware/backup_config

03 // STAGE

Trust the published hash

Download the entitled Broadcom or OEM offline depot on the admin workstation, verify its published SHA-256, and then stage it on a datastore the host can read.

Use the exact depot path when listing profiles. Copy the exact profile name from that output; do not infer it from the ZIP filename.

What breaks first

Wrong depot, truncated upload, incorrect OEM image, or a profile name copied from a different release all fail before the useful work starts.

ESXi Shell

esxcli software sources profile list \
  -d "/vmfs/volumes/<datastore-or-uuid>/patches/<bundle>.zip"

04 // MAINTENANCE

Evacuate before you mutate

Maintenance mode is an operational state, not just a command prerequisite. DRS can automate evacuation only when automation, VM constraints, passthrough, affinity rules, and vMotion eligibility allow it.

For vSAN, choose a capacity-aware data migration policy explicitly and inspect resync/object health. The generic vim-cmd entry command does not express that policy.

What breaks first

Pinned or non-vMotionable workloads, active resync, insufficient capacity, or an unexamined vSAN policy can block or endanger the transition.

Non-vSAN example

vim-cmd hostsvc/maintenance_mode_enter
vim-cmd hostsvc/hostsummary | grep inMaintenanceMode

05 // DRY RUN + APPLY

Read the transaction twice

The dry run simulates the image transaction and reports adds, upgrades, removals, dependency checks, and reboot requirements. It does not replace release notes, HCL, OEM firmware/driver checks, health checks, or recovery planning.

Use profile update for normal patching. It applies newer/new content and ignores lower-revision content. Review every warning before running the same command without --dry-run.

What breaks first

Unexpected removals, dependency conflicts, acceptance failures, and hardware warnings are reasons to stop and reconcile the desired image.

ESXi 7 / 8

esxcli software profile update \
  -d "/vmfs/volumes/<datastore-or-uuid>/patches/<bundle>.zip" \
  -p "<exact-profile>" \
  --dry-run

# Only after the dry-run result is accepted:
esxcli software profile update \
  -d "/vmfs/volumes/<datastore-or-uuid>/patches/<bundle>.zip" \
  -p "<exact-profile>"

06 // REBOOT + VALIDATE

Connected is not validated

Reboot only after capturing the transaction result. After the host returns, compare version, build, profile, acceptance level, component inventory, and VIB inventory; then validate management, networking, storage, vMotion, vSAN/NSX health, alarms, and lifecycle compliance.

Rollback is conditional: Shift+R can revert a previous bootbank in supported cases, but tools-light is not rolled back and a later reboot-requiring VIB transaction can consume the rollback image.

Exit maintenance mode only after service validation. Restore SSH and ESXi Shell to their previous policy, remove stale staging content when required, and preserve the evidence.

What breaks first

A host can reconnect while a vmkernel adapter, storage path, driver, service, or lifecycle compliance state is still wrong.

Post-patch

esxcli system shutdown reboot -r 'apply patch'

# After reconnect:
vmware -vl
esxcli system version get
esxcli software profile get
esxcli software acceptance get
esxcli software component list
esxcli software vib list

# After service validation:
vim-cmd hostsvc/maintenance_mode_exit

ESXi software profile update, profile install, and VIB command comparison
Operation	Behavior	Use	Primary risk
`profile update`	Applies newer and new content; ignores lower revisions already installed.	Default for ESXi 7/8 patching with an approved image profile.	OEM or custom content may remain, producing an updated rather than literal profile match.
`profile install`	Aligns more aggressively to the target profile and can remove or overwrite packages; `--allow-downgrades` can explicitly permit lower revisions.	Deliberate image replacement when the image design and removals are explicitly approved.	Unintended driver or agent removal and loss of required OEM content.
`vib update/install`	Operates at individual VIB level.	Vendor, OEM, or support-documented individual agent, driver, component, or VIB operation.	Unsupported for changing or updating the ESXi image/version from ESXi 8.0 U2 onward.

These are not shortcuts Do not normalize --force, --no-sig-check, --no-hardware-warning, --allow-downgrades, or --maintenance-mode. The last flag does not evacuate workloads or put the host into real maintenance mode.

05 // FAULT DRILL

Troubleshooting instinct

WHAT DO YOU CHECK FIRST?

Follow ownership and state before changing flags. Each answer explains the first useful move.

Fault 1 / 3

Loading fault scenario...

Select the first investigation point.

06 // EVIDENCE

Close the change

BUILD THE HANDOFF NOTE.

Turn the window into a concise record for the next operator, the lifecycle owner, and the incident timeline.

Change ID Window date Host Outcome Before build After build Applied bundle Applied profile Bundle SHA-256 Backup evidence vSAN maintenance decision Validation notes These values come from observed host/change evidence, not from the browser simulation.

Draft evidence note pending.

07 // SOURCE CONTROL

Authoritative references

VERIFY AGAINST THE RELEASE.

These Broadcom knowledge articles define the supported scope and the operational caveats used in this runbook. Release notes, compatibility data, OEM guidance, and your support entitlement still govern the actual change.

Patching ESXi host using Command Line Core ESXi 7.x/8.x offline-depot commands, options, and update/install behavior. KB 343840.
Upgrading, updating or applying a patch using esxcli Operational procedure, VMware depot profile naming, OEM content behavior, and current VIB-command qualification. KB 390985.
Back up and restore ESXi host configuration Configuration synchronization, backup, restore prerequisites, UUID/build, TPM, Auto Deploy, and DPU limitations. KB 313510.
Installing ESXi using vSphere Auto Deploy Authoritative image, rule, boot, and provisioning workflow for hosts owned by Auto Deploy.
Revert to a previous ESXi version Shift+R bootbank rollback behavior and limitations. KB 316592.
Download latest ISOs and ESXi patches Broadcom Support Portal download route for entitled vSphere content. KB 372545.
vSphere downloads, OEM images, patches, and add-ons OEM custom-image and add-on locations in the Broadcom Support Portal. KB 366685.
Using ESXi Shell Enablement, access, security policy, and operational use of ESXi Shell. KB 311213.
VCF or VVF 9.0 downloads ESX 9 naming and VCF/VVF entitlement context. Not evidence for reusing the ESXi 7/8 CLI procedure. KB 401497.
Synchronize inventory after an out-of-band upgrade Version-specific VCF 5.2 reconciliation example. Do not generalize this API procedure to other VCF releases. KB 324050.
SDDC Manager out-of-band upgrade precheck Why manually changed host versions can surface as lifecycle drift in VCF. KB 390727.
End of General Support for vSphere 7.0 Dedicated lifecycle confirmation that ESXi 7.x reached End of General Support on October 2, 2025. KB 415405.
Product Lifecycle | Broadcom Support Portal Official support-phase status for vSphere and ESXi releases. Broadcom Support Portal sign-in may be required.

SOURCE SET REVIEWED // 15 JUL 2026 // ALWAYS RECHECK CURRENT ARTICLE REVISION AND PRODUCT RELEASE NOTES

ESXi CLI PATCHING.

WHO OWNS THIS LIFECYCLE?

NO CHECKMARKS, NO CHANGE.

RUN THE WINDOW BEFORE THE WINDOW.

THE CONTROLLED WORKFLOW.

Freeze the before-state

Make recovery real

Trust the published hash

Evacuate before you mutate

Read the transaction twice

Connected is not validated

WHAT DO YOU CHECK FIRST?

Loading fault scenario...

BUILD THE HANDOFF NOTE.

VERIFY AGAINST THE RELEASE.