Loading story…
Broadcom has released emergency patches for CVE-2026-47876, a critical out-of-bounds write flaw in the VMXNET3 virtual network adapter used by VMware ESX environments. The vulnerability, rated CVSS 9.3 and mapped to CWE-787, allows an attacker with local administrator or root privileges inside a guest VM using VMXNET3 to execute code on the underlying host, creating a guest-to-host escape condition. Affected offerings include VMware ESX, VMware Cloud Foundation, VMware vSphere Foundation, and VMware Telco Cloud Platform across specified version ranges.
Broadcom said there is no evidence of active exploitation, no complete workaround, and no published indicators of compromise, increasing pressure on defenders to apply vendor fixes quickly. Security researchers warned that successful exploitation could break VM isolation and expose the hypervisor, adjacent virtual machines, management systems, workloads, and infrastructure secrets, particularly in multi-tenant environments. The flaw was privately reported by Nguyen Hoang Thach of STARLabs SG through Pwn2Own and the Zero Day Initiative, and organizations are being urged to patch affected builds immediately and treat any privileged compromise of a VMXNET3-enabled guest on an unpatched host as a potential hypervisor incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On July 29, 2026, Broadcom published a security advisory and emergency security updates for CVE-2026-47876, a critical out-of-bounds write vulnerability in the VMware ESX VMXNET3 virtual network adapter that can enable guest-to-host code execution. The remediation guidance is to apply vendor patches and update affected VMware products to fixed versions.
Broadcom said CVE-2026-47876 was privately reported by Nguyen Hoang Thach of STARLabs SG through the Pwn2Own competition operated by Trend Micro's Zero Day Initiative. The references do not provide a specific date for the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom released fixes for three actively exploited VMware zero-day vulnerabilities affecting **ESXi**, **Workstation**, and **Fusion**, warning that the bugs can be chained to achieve a full virtual machine escape from a guest system to the hypervisor. The flaws, tracked as `CVE-2025-22224`, `CVE-2025-22225`, and `CVE-2025-22226`, include a critical issue and can enable code execution, sandbox escape, and access to sensitive memory when an attacker already has administrative privileges inside a guest VM. Microsoft Threat Intelligence Center reported the in-the-wild exploitation, and security researchers described the campaign as **ESXicape**. Affected products include unpatched **VMware ESXi 7.0 and 8.0**, **VMware Workstation 17.x before 17.6.3**, and **VMware Fusion 13.x before 13.6.3**. Organizations running VMware Cloud Foundation environments may need to account for Broadcom’s product-specific patching requirements and compatibility constraints when deploying updates, including cases where some component updates are handled through the in-product Flexible BOM rather than the Async Patch Tool. Defenders are being urged to apply the relevant ESXi patches immediately and upgrade desktop hypervisor products to the fixed releases to block guest-to-host compromise.
Jul 24, 2026
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026