Close Menu
    VMware & Virtualization

    How to Patch the vCenter Server Appliance from the Command Line

    By 8 Mins Read
    vCenter Server patching

    Patching the VMware vCenter Server Appliance (VCSA) updates its software and can address product defects and security issues. This guide explains how to apply a full patch ISO from the Appliance Shell by staging its packages, reviewing the staged release, installing the update, and rebooting the appliance.

    The patch process interrupts vCenter Server services and requires a maintenance window. Before starting, verify the current version and target release, confirm that a valid backup is available, and ensure you have a way to access the ESXi host directly if vCenter becomes unavailable during the update.

    vCenter Server 7.x lifecycle notice: Broadcom lists October 2, 2025 as the end of general support for vCenter Server 7.x. As of September 2026, vCenter 7.x is outside general support. If you still operate this version, plan an upgrade to a currently supported release and confirm the appropriate upgrade path, licensing, and compatibility before proceeding. Applying an older patch does not extend the product’s support lifecycle.

    Scope and Important Considerations

    This procedure is for a vCenter Server Appliance updated from an ISO attached to its virtual CD/DVD drive. It uses the appliance’s own software-packages commands; these are not ESXi host patching commands.

    The ISO must be the full patch ISO, whose filename ends in -FP.iso. Do not substitute a full installation ISO or an ESXi patch ISO. Broadcom’s current download guidance distinguishes patch media from full installation media.

    This article covers a standalone VCSA. If your environment uses vCenter High Availability, Enhanced Linked Mode, or another configuration with special sequencing requirements, follow the release-specific procedure for that topology rather than applying this standalone workflow without modification.

    This procedure updates the vCenter Server Appliance, not the ESXi hypervisor. To patch the host itself, see How to Patch an ESXi Host Using the Command Line.

    Before You Begin

    Schedule a change window. During the update, vCenter services stop, and the appliance must reboot. Administrators may temporarily lose the vSphere Client and vCenter API access.

    Confirm that you have:

    • Administrator credentials for the VCSA and an accessible root password that is not expired.
    • A tested VCSA backup stored outside the appliance. Broadcom recommends using the VAMI backup and restore workflow; a powered-off snapshot may be considered as an additional recovery measure where appropriate, but should not be the only backup.
    • The target patch ISO and release notes for the exact vCenter version and build.
    • A datastore accessible to the ESXi host that runs the VCSA, with enough space for the ISO.
    • Direct access to the ESXi Host Client or out-of-band management, especially if this VCSA manages the only host on which it runs.
    • Sufficient appliance storage and a healthy VCSA before starting the installation.

    Do not choose a release solely because a draft or old screenshot calls it “latest.” The example release VC-7.0U3h is no longer a current recommendation. Check the Broadcom build list and release information for the correct target, then confirm that the upgrade sequence is supported.

    1. Record the Current Version and Build

    Open the vCenter Server Appliance Management Interface (VAMI) at:

    https://<vcenter-fqdn-or-ip>:5480

    Sign in and record the current version and build from the appliance summary. You can also check the build from the VCSA command line with:

    vpxd -v

    Record the current build in the change plan so that you can compare it with the installed build after the update. Broadcom maintains a version and build reference for vCenter Server. 5

    2. Back Up the VCSA

    Before updating, create and verify a backup using the VAMI backup workflow. Open https://<vcenter-fqdn-or-ip>:5480, go to Backup, configure an appropriate destination, and confirm that the backup completes successfully. Store the backup outside the VCSA so that it remains available if the appliance cannot start.

    A backup is essential for recovery. Do not assume that an ESXi snapshot alone is an adequate replacement for a VCSA file-based backup. If your change policy also requires an offline snapshot, follow the applicable Broadcom guidance and ensure it is taken with the appliance powered off.

    3. Download the Correct Full Patch ISO

    Sign in to the Broadcom Support Portal and locate the patch for the intended vCenter Server release. Patch packages are generally listed under Solutions; full installation media is generally listed under Products. If the release is not visible in one section, check the other. Download availability depends on the account’s product and licensing entitlements.

    Choose the full patch ISO with a filename ending in -FP.iso. Review its release notes and confirm that it is an applicable target for the installed vCenter version. Do not select an ESXi patch or a full VCSA installer ISO by mistake.

    4. Upload and Attach the ISO to the VCSA

    Identify the ESXi host on which the VCSA virtual machine is running. Using the vSphere Client or, if vCenter is unavailable, the ESXi Host Client, upload the patch ISO to a datastore accessible to that host.

    Edit the VCSA virtual machine settings. For its CD/DVD drive, select Datastore ISO File, browse to the uploaded -FP.iso, and connect the device. Confirm that Connected is selected. The ISO must remain mounted while the appliance stages the packages.

    If the VCSA runs on the only available ESXi host, confirm that you can sign in to that host directly before beginning. During the patch, the vCenter Server itself will be unavailable.

    5. Connect to the Appliance Shell

    Enable SSH access for the VCSA in the VAMI if it is not already enabled. Connect to the appliance using SSH and sign in with an administrative account. Enter the Appliance Shell if the session does not open there automatically:

    /bin/appliancesh

    Run the VCSA package commands from the Appliance Shell. Do not switch to the underlying Bash shell for the staging and installation steps in this guide.

    6. Stage and Review the Patch Packages

    Stage packages from the attached ISO and accept the end-user license agreement:

    software-packages stage --iso --acceptEulas

    Staging copies and validates the patch packages in the appliance. It does not install the update. Wait for the command to finish and confirm that it reports successful staging.

    List the staged packages and review the target version before installing:

    software-packages list --staged

    Check that the staged release is the one you intended to install. If the ISO is not detected, verify that the correct -FP.iso is mounted and that the CD/DVD drive is connected. If staging reports insufficient space or validation errors, stop and resolve the issue instead of attempting to force the installation. 1

    7. Install the Staged Update

    After confirming the staged release, start the installation:

    software-packages install --staged

    The installation can take several minutes. Keep the SSH session open and wait for the command to finish. Do not interrupt the process or start another update command while installation is in progress.

    A successful update reports that the packages were upgraded and that a reboot is required. If the command reports an error or does not complete successfully, do not reboot or retry blindly. Preserve the error output and follow the Broadcom troubleshooting guidance for the specific failure.

    8. Reboot and Verify vCenter Server

    When the installation reports success and requests a restart, reboot the appliance:

    shutdown reboot -r "vCenter patch"

    The SSH session will disconnect. Wait for the VCSA to finish starting before reconnecting. Then verify the appliance status in the VAMI and confirm the installed version and build in the vSphere Client or with:

    vpxd -v

    Confirm that vCenter services are healthy and that the vSphere Client, inventory, hosts, clusters, and required integrations are available. If the VCSA manages the ESXi host on which it runs, reconnect to vCenter only after the appliance is fully operational.

    If the appliance does not return to service or the patch fails, collect diagnostic information before restoring a backup or reverting a recovery point. Broadcom’s patching guidance describes collecting a support bundle with vc-support -l from the appliance shell environment. 2

    Summary

    The VCSA CLI patch workflow is to verify the current build, create and verify a backup, download the correct full patch ISO, attach it to the appliance, stage and review its packages, install the staged update, and reboot. Confirm the resulting build and service health before closing the maintenance window.

    For vCenter Server 7.x, remember that general support ended on October 2, 2025. Use this procedure only when it fits your environment and support entitlements, and include a supported upgrade plan in lifecycle maintenance.

    External References

    Share.

    Infrastructure Engineer with hands-on experience in virtualization, Linux, Windows Server, and enterprise infrastructure troubleshooting. I work with real-world infrastructure environments and technical labs, focusing on diagnosing problems, understanding root causes, and documenting practical solutions. DPC Virtual Tips was created to share hands-on troubleshooting guides, lab experiences, technical procedures, and lessons learned while working with technologies such as VMware, Linux, HPC/Slurm, networking, storage, and infrastructure automation with Python.

    Related Posts

    Leave A Reply