Loading story…
Broadcom patched two vulnerabilities in VMware Workstation and Fusion that allow an attacker with local administrator privileges in a guest virtual machine to execute code on its host. CVE-2026-59346 is a critical (CVSS 9.3) integer-overflow vulnerability in the VMXNET3 virtual network adapter, while CVE-2026-59347 is a high-severity (CVSS 8.1) stack-based buffer overflow in the Host-Guest File System (HGFS) that can execute code in the VM's host-side VMX process.
The flaws affect VMware Workstation and Fusion versions 25H2 and 26H1 and are fixed in version 26H1u1 under advisory VMSA-2026-0007. Broadcom said no workarounds are available, making prompt upgrades necessary for affected environments. The vulnerabilities were privately reported, with no indication of exploitation in the wild.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Broadcom issued advisory VMSA-2026-0007 disclosing CVE-2026-59346, a critical VMXNET3 integer-overflow flaw, and CVE-2026-59347, an HGFS stack-based buffer overflow. The flaws affect Workstation and Fusion 25H2 and 26H1, can enable a guest VM administrator to execute code on the host, and were fixed in version 26H1u1; Broadcom said no workarounds are available.
Separate VMware vCenter vulnerabilities CVE-2026-59309 and CVE-2026-59310 were reported as actively exploited, with CVE-2026-59310 suspected of weaponization by a China-nexus APT actor. The activity was estimated to affect 361 unique victim IP addresses in 47 countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
bashoverflow.medium.com
Open sourcescworld.com
Open sourcecsirt.sk
Open sourcethreataft.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom released fixes for three actively exploited VMware zero-day vulnerabilities affecting **ESXi**, **Workstation**, and **Fusion**, warning that the bugs can be chained to achieve a full virtual machine escape from a guest system to the hypervisor. The flaws, tracked as `CVE-2025-22224`, `CVE-2025-22225`, and `CVE-2025-22226`, include a critical issue and can enable code execution, sandbox escape, and access to sensitive memory when an attacker already has administrative privileges inside a guest VM. Microsoft Threat Intelligence Center reported the in-the-wild exploitation, and security researchers described the campaign as **ESXicape**. Affected products include unpatched **VMware ESXi 7.0 and 8.0**, **VMware Workstation 17.x before 17.6.3**, and **VMware Fusion 13.x before 13.6.3**. Organizations running VMware Cloud Foundation environments may need to account for Broadcom’s product-specific patching requirements and compatibility constraints when deploying updates, including cases where some component updates are handled through the in-product Flexible BOM rather than the Async Patch Tool. Defenders are being urged to apply the relevant ESXi patches immediately and upgrade desktop hypervisor products to the fixed releases to block guest-to-host compromise.
Jul 24, 2026
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026
Broadcom has released emergency patches for **`CVE-2026-47876`**, a critical **out-of-bounds write** flaw in the **VMXNET3** virtual network adapter used by VMware ESX environments. The vulnerability, rated **CVSS 9.3** and mapped to **`CWE-787`**, allows an attacker with **local administrator or root privileges inside a guest VM** using VMXNET3 to execute code on the underlying host, creating a **guest-to-host escape** condition. Affected offerings include **VMware ESX**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform** across specified version ranges. Broadcom said there is **no evidence of active exploitation**, no complete workaround, and no published indicators of compromise, increasing pressure on defenders to apply vendor fixes quickly. Security researchers warned that successful exploitation could break VM isolation and expose the hypervisor, adjacent virtual machines, management systems, workloads, and infrastructure secrets, particularly in multi-tenant environments. The flaw was privately reported by **Nguyen Hoang Thach of STARLabs SG** through **Pwn2Own** and the **Zero Day Initiative**, and organizations are being urged to patch affected builds immediately and treat any privileged compromise of a VMXNET3-enabled guest on an unpatched host as a potential hypervisor incident.
Aug 1, 2026