Loading story…
Broadcom released VMSA-2026-0006 to patch five vulnerabilities affecting VMware vCenter, ESXi, Workstation, and Fusion, including three critical flaws. The most severe issues are CVE-2026-59309 and CVE-2026-59310, both rated CVSS 9.8, which can be exploited remotely against vCenter by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are no workarounds and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments.
The advisory also fixes CVE-2026-47876, a critical VM escape in ESXi’s VMXNET3 virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: CVE-2026-41703, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and CVE-2026-41709, a low-severity ESXi logging-related bug. Broadcom said it is not aware of in-the-wild exploitation and published patching guidance and an FAQ for affected customers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In its advisory materials, Broadcom said it was not aware of in-the-wild exploitation of the patched vulnerabilities. The company also urged organizations to prioritize installing updates and published FAQ guidance on impact and patching requirements.
Broadcom published security advisory VMSA-2026-0006 covering five vulnerabilities affecting VMware vCenter, ESXi, Workstation, and Fusion, and released patches for the issues. The advisory includes three critical flaws: CVE-2026-47876 in ESXi VMXNET3, CVE-2026-59309 in vCenter authentication, and CVE-2026-59310 in vCenter remote code execution.
VMware published remediation guidance for VMware Telco Cloud Platform and VMware Telco Cloud Infrastructure in response to VMSA-2026-0006. The notice identified affected Telco Cloud versions, listed the five CVEs involved, and directed customers to fixed vCenter and ESX/ESXi versions or to support for upgrade and mitigation guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
22 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcecyberveille.ch
Open sourcecsoonline.com
Open sourcemalware.news
Open sourcevmware.com
Open sourcesdxcentral.com
Open sourcerunzero.com
Open sourceknowledge.broadcom.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom released fixes for three actively exploited VMware zero-day vulnerabilities affecting **ESXi**, **Workstation**, and **Fusion**, warning that the bugs can be chained to achieve a full virtual machine escape from a guest system to the hypervisor. The flaws, tracked as `CVE-2025-22224`, `CVE-2025-22225`, and `CVE-2025-22226`, include a critical issue and can enable code execution, sandbox escape, and access to sensitive memory when an attacker already has administrative privileges inside a guest VM. Microsoft Threat Intelligence Center reported the in-the-wild exploitation, and security researchers described the campaign as **ESXicape**. Affected products include unpatched **VMware ESXi 7.0 and 8.0**, **VMware Workstation 17.x before 17.6.3**, and **VMware Fusion 13.x before 13.6.3**. Organizations running VMware Cloud Foundation environments may need to account for Broadcom’s product-specific patching requirements and compatibility constraints when deploying updates, including cases where some component updates are handled through the in-product Flexible BOM rather than the Async Patch Tool. Defenders are being urged to apply the relevant ESXi patches immediately and upgrade desktop hypervisor products to the fixed releases to block guest-to-host compromise.
Jul 24, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026
Broadcom has released emergency patches for **`CVE-2026-47876`**, a critical **out-of-bounds write** flaw in the **VMXNET3** virtual network adapter used by VMware ESX environments. The vulnerability, rated **CVSS 9.3** and mapped to **`CWE-787`**, allows an attacker with **local administrator or root privileges inside a guest VM** using VMXNET3 to execute code on the underlying host, creating a **guest-to-host escape** condition. Affected offerings include **VMware ESX**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform** across specified version ranges. Broadcom said there is **no evidence of active exploitation**, no complete workaround, and no published indicators of compromise, increasing pressure on defenders to apply vendor fixes quickly. Security researchers warned that successful exploitation could break VM isolation and expose the hypervisor, adjacent virtual machines, management systems, workloads, and infrastructure secrets, particularly in multi-tenant environments. The flaw was privately reported by **Nguyen Hoang Thach of STARLabs SG** through **Pwn2Own** and the **Zero Day Initiative**, and organizations are being urged to patch affected builds immediately and treat any privileged compromise of a VMXNET3-enabled guest on an unpatched host as a potential hypervisor incident.
Aug 1, 2026