Loading story…
Broadcom released a security update for VMware Fusion to fix CVE-2026-41702, a high-severity local privilege escalation flaw that could allow a non-administrative local user to gain root on affected macOS systems. The bug is a time-of-check time-of-use (TOCTOU) issue in operations performed by a SETUID binary, meaning attackers who already have local access could escalate privileges and potentially take full control of a vulnerable machine.
The vulnerability affects VMware Fusion versions prior to 26H1, according to Broadcom's advisory, which was also highlighted by the Canadian Centre for Cyber Security. The flaw was privately reported by security researcher Mathieu Farrell, and officials urged users and administrators to review the vendor advisory and apply the update promptly, particularly because VMware Fusion is widely used by developers, IT teams, and security researchers, increasing the risk from compromised accounts or insider misuse.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-14, the Canadian Centre for Cyber Security issued advisory AV26-469 referencing Broadcom's VMware Fusion vulnerability notice and urged administrators to review the advisory and apply the necessary updates.
On 2026-05-14, Broadcom published a security advisory and released updates for VMware Fusion to fix CVE-2026-41702, a high-severity local privilege escalation vulnerability affecting versions prior to 26H1.
Security researcher Mathieu Farrell privately reported CVE-2026-41702, a TOCTOU privilege escalation issue in a VMware Fusion SETUID binary that could let a non-administrative local user gain root access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom patched two vulnerabilities in VMware Workstation and Fusion that allow an attacker with local administrator privileges in a guest virtual machine to execute code on its host. **CVE-2026-59346** is a critical (CVSS 9.3) integer-overflow vulnerability in the VMXNET3 virtual network adapter, while **CVE-2026-59347** is a high-severity (CVSS 8.1) stack-based buffer overflow in the Host-Guest File System (HGFS) that can execute code in the VM's host-side VMX process. The flaws affect VMware Workstation and Fusion versions 25H2 and 26H1 and are fixed in version **26H1u1** under advisory `VMSA-2026-0007`. Broadcom said no workarounds are available, making prompt upgrades necessary for affected environments. The vulnerabilities were privately reported, with no indication of exploitation in the wild.
Sep 10, 2026
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026
Broadcom has released **VMSA-2026-0004** to fix three stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations, tracked as `CVE-2026-41722`, `CVE-2026-41723`, and `CVE-2026-41724`. The flaws affect VMware Cloud Foundation Operations and related enterprise cloud environments, including **VMware Aria Operations**, **VMware Telco Cloud Platform**, and **VMware vSphere Foundation** deployments. Broadcom rated the issues **Important**, with a maximum **CVSS v3.1 score of 8.0** and vector `AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`. According to the advisory, an authenticated user with privileges to create policies, views, or text widgets could inject malicious scripts that execute when viewed and potentially perform **administrative actions** inside the platform. Broadcom said the vulnerabilities were privately reported and published remediation guidance, including upgrading **Aria Operations to version 8.18.6**. Organizations running affected VMware management platforms have been urged to review exposed deployments and apply the available patches promptly.
Jun 29, 2026