How to Patch an ESXi Host Using the Command Line

Patching an ESXi host from the command line is useful when you need a controlled maintenance procedure for a standalone host or a host managed outside a cluster lifecycle workflow. The recommended profile-based method uses an offline bundle ZIP and esxcli software profile update. It is not the same as installing an ESXi ISO.

Before changing a production host, confirm the target release is compatible with the server hardware and installed components, back up the host configuration, and plan for a maintenance window. If the host belongs to a cluster managed by vSphere Lifecycle Manager, use the cluster’s image or baseline workflow unless your operating procedure specifically requires a manual CLI update. Lifecycle Manager can check compliance and remediate hosts against the cluster’s desired image.

ESXi 7 lifecycle notice: Broadcom lists October 2, 2025 as the end of general support for ESXi 7.x and vCenter Server 7.x. If you are maintaining ESXi 7, treat this procedure as maintenance of a version outside general support and plan a move to a currently supported release. Confirm your organization’s licensing, support entitlement, hardware compatibility, and upgrade path before proceeding.

What You Need

This procedure assumes that you are applying a patch to an existing ESXi installation using an offline bundle. An upgrade to a different major release can have additional compatibility and sequencing requirements, so use the applicable upgrade guide rather than treating every upgrade as a patch.

You will need:

• Administrator access to the ESXi host and its datastore.
• The correct offline bundle ZIP for the host’s release and hardware vendor.
• A maintenance window long enough to evacuate or shut down virtual machines and reboot the host.
• A verified backup of the ESXi host configuration and separate backups or recovery plans for the virtual machines and business data.
• Console or out-of-band management access in case the host does not return to the network after reboot.

Broadcom’s download portal may show patches under Solutions and full releases under Products. Download availability depends on the product and license entitlements associated with the account. Select the offline bundle ZIP when following this procedure; an ISO is a different installation media format.

1. Check the Current ESXi Version and Build

Connect to the ESXi Shell or SSH session and record the installed version and build:

vmware -vl

You can also review the version and build in the vSphere Client. Record this information in the change plan so you can confirm the result after reboot. Broadcom documents vmware -v as a command-line method for checking an ESXi build.

Before proceeding, check the Broadcom Compatibility Guide for the server model, storage and network adapters, and any vendor-specific components in the host. A patch that is valid for ESXi in general may still be unsuitable for a particular server configuration.

2. Back Up the Host Configuration

Synchronize the host configuration to persistent storage and create a configuration backup:

vim-cmd hostsvc/firmware/sync_config
vim-cmd hostsvc/firmware/backup_config

The backup command returns a URL for the configuration archive. Download that file to a location outside the ESXi host and verify that it is available before continuing. Keep the archive protected because it contains host configuration information. Broadcom notes that configuration restore has build and host-identity requirements; a configuration backup is not a substitute for backing up virtual machines or their data.

3. Download and Upload the Offline Bundle

Sign in to the Broadcom Support Portal and locate the patch or release that matches the planned target. Check the release notes and compatibility information before downloading. Choose the offline bundle ZIP, not the ISO.

Upload the ZIP to a datastore accessible to the host. You can use the Datastore Browser in the vSphere Client or connect directly to the host. For example, create a directory such as patches and upload the file there. If you temporarily enable SSH or another transfer service to copy the bundle, disable that service after the transfer and maintenance work are complete.

For the examples below, replace the datastore name, directory, and ZIP filename with the values used in your environment:

/vmfs/volumes/<datastore>/<directory>/<offline-bundle>.zip

Confirm that the file exists and that the datastore has sufficient free space:

df -h
ls -lh /vmfs/volumes/<datastore>/<directory>/

4. Prepare the Host for Maintenance

If the host is managed by vCenter, coordinate the work through the normal change process. Migrate its virtual machines to other hosts when possible. If migration is not available, shut down the virtual machines cleanly according to their service requirements.

A host must be in maintenance mode before the update. Enter maintenance mode from the vSphere Client or run:

vim-cmd /hostsvc/maintenance_mode_enter

Check the status:

vim-cmd /hostsvc/hostsummary | grep inMaintenanceMode

Proceed only after the host has entered maintenance mode and all workloads have been evacuated or shut down. Do not force the update past errors or compatibility warnings without understanding their cause.

Single-host vCenter note: If the vCenter Server virtual machine runs on the only ESXi host being patched, shut it down as part of the maintenance plan. You will not be able to manage that host through vCenter while the vCenter Server VM is offline. Ensure you can connect directly to the ESXi Host Client or use out-of-band console access before starting.

5. Identify the Image Profile in the Bundle

List the profiles contained in the offline bundle:

esxcli software sources profile list \
  -d /vmfs/volumes/<datastore>/<directory>/<offline-bundle>.zip

The command returns one or more profile names. Copy the exact profile intended for the host and target release. Do not guess the name or select a profile solely because it contains the word standard; confirm it matches the downloaded bundle and the intended update.

Set the profile name and bundle path in the command below. The example uses placeholders; replace them before running it:

esxcli software profile update --dry-run \
  -p "<image-profile-name>" \
  -d "/vmfs/volumes/<datastore>/<directory>/<offline-bundle>.zip"

The --dry-run option reports the planned transaction without applying it. Review the output. If it reports dependency conflicts, unsupported components, or other unexpected actions, stop and investigate before proceeding.

6. Apply the Patch

After the dry run completes successfully and the planned changes are understood, run the profile update without --dry-run:

esxcli software profile update \
  -p "<image-profile-name>" \
  -d "/vmfs/volumes/<datastore>/<directory>/<offline-bundle>.zip"

The profile update command updates matching packages from the selected profile while preserving other installed VIBs that are not replaced by the profile. By contrast, profile install can remove VIBs that are not present in the selected profile. For a patch-style update, use profile update unless the applicable vendor procedure specifically instructs otherwise. Do not use flags that bypass signature, dependency, or security checks as a shortcut.

Wait for the command to finish and read the complete output. A message that says a reboot is required means the update transaction completed but the new image is not active until the host restarts. If the command reports an error, do not reboot automatically; resolve the error or consult the release-specific Broadcom guidance first.

7. Reboot the Host

When the update completes successfully and the host remains in maintenance mode, reboot it:

esxcli system shutdown reboot -r "Apply ESXi patch"

The SSH session will disconnect while the host restarts. Wait for the host to finish booting, then reconnect through the ESXi Host Client, SSH, or out-of-band console.

8. Verify the Update and Return the Host to Service

Check the version and build again:

vmware -vl

Compare the output with the target release and build recorded in the change plan. You can also inspect the active image profile:

esxcli software profile get

If the expected version is active and the host is healthy, exit maintenance mode from the vSphere Client or run:

vim-cmd hostsvc/maintenance_mode_exit

Then verify host connectivity, storage visibility, networking, and the status of required agents or services. Power on or migrate virtual machines according to the maintenance plan. If the host is part of a cluster, confirm that the cluster and its workloads have returned to the expected state.

Troubleshooting Notes

The profile name is not found

Run esxcli software sources profile list against the exact ZIP file uploaded to the datastore. Check that the path is correct and that the selected profile name exactly matches the command output. A profile from a different bundle will not be found.

The command reports dependency or acceptance-level errors

Do not bypass validation by adding --force or disabling signature checks. Confirm that the bundle is intended for the host and that installed vendor drivers and components are compatible. Review the host’s configuration and the release-specific guidance, then contact the vendor or Broadcom support if the conflict is unclear. Broadcom warns that bypass options can undermine security or host stability.

The host does not return after reboot

Use out-of-band management or the physical console to inspect the boot process. Check the server vendor’s recovery instructions and the Broadcom procedure for reverting to a previous ESXi version before attempting a rollback. Keep the configuration backup and the original bundle available, but do not assume that restoring the configuration alone will revert the installed image.

To Wrap This Up

The CLI patch workflow is to back up the ESXi configuration, download and upload the correct offline bundle ZIP, place the host in maintenance mode, identify and simulate the image-profile update, apply it, reboot, and verify the resulting build.

For cluster-managed hosts, use the vSphere Lifecycle Manager workflow where appropriate. For ESXi 7.x, account for the end of general support and plan a supported upgrade path rather than treating an old patch as a substitute for lifecycle planning.

External References