Broadcom Patches Three Critical VMware Vulnerabilities: Authentication Bypass, RCE and VM Escape

Broadcom has released a set of security updates for its VMware products — ESX, vCenter, Workstation and Fusion. In total, several vulnerabilities have been fixed, three of which were assigned critical status.

Two Critical Holes in vCenter

The first — CVE-2026-59309 (CVSS 9.8) — is an authentication bypass in VMware vCenter. According to Broadcom's description, an attacker with network access to vCenter can exploit the issue to bypass authentication and gain unauthorized access to the system.

The second — CVE-2026-59310 (CVSS 9.8) — is a directory traversal vulnerability in the same vCenter. An attacker with network access is able to use it to execute arbitrary code.

Both issues have been fixed in VMware Cloud Foundation and vSphere Foundation versions 9.1.x (fix 9.1.0.0300) and 9.0.x (9.0.2.0100), as well as in VMware vCenter 8.0 (build 8.0 U3k); for the Cloud Foundation 5.x line an asynchronous patch to 8.0 U3k is provided.

Escape from the Virtual Machine

The third critical vulnerability — CVE-2026-47876 (CVSS 9.3) — is an out-of-bounds write in the VMXNET3 virtual network adapter in VMware ESX. Broadcom characterizes it outright as a virtual machine escape: an attacker who already holds local administrative privileges inside a guest VM with a VMXNET3 adapter can execute code on the ESX host.

The Remaining Fixes

In addition to the three critical flaws, two more issues have been fixed. CVE-2026-41703 (CVSS 7.6) is an out-of-bounds read in VMware ESX that a user with VM deployment privileges can trigger to disclose information or cause a denial of service; on Workstation and Fusion the impact is limited to data leakage alone. CVE-2026-41709 (CVSS 2.7) is insufficient logging in ESX that allows a malicious administrator to perform certain operations without leaving traces in the logs.

Broadcom emphasizes that it has no information about any of these vulnerabilities being exploited in real-world attacks. Nevertheless, given the criticality of vCenter and ESX to enterprise infrastructure, administrators would do well not to postpone installing the updates.

Source: The Hacker News