Full Report
Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter. "A malicious actor with network access to vCenter
Analysis Summary
# Vulnerability: Multiple Critical Flaws in VMware Infrastructure (July 2026)
## CVE Details
- **CVE ID:** CVE-2026-59309, CVE-2026-59310, CVE-2026-47876
- **CVSS Score:** 9.8 (Critical) for vCenter flaws; 9.3 (Critical) for ESX VM Escape
- **CWE:** Authentication Bypass, Directory Traversal, Out-of-bounds Write
## Affected Systems
- **Products:** VMware vCenter, ESX (vSphere/Cloud Foundation), Workstation, and Fusion.
- **Versions:**
- vCenter 8.0, 9.0, 9.1
- VMware Cloud Foundation (VCF) 5.x, 9.x
- VMware Workstation and Fusion (specific to CVE-2026-41703)
- **Configurations:** Systems utilizing the **VMXNET3** virtual network adapter are specifically vulnerable to the VM escape flaw (CVE-2026-47876).
## Vulnerability Description
Broadcom has addressed three primary critical vulnerabilities:
1. **CVE-2026-59309 (vCenter):** An authentication bypass flaw allowing unauthorized access to the management interface.
2. **CVE-2026-59310 (vCenter):** A directory traversal vulnerability allowing remote code execution (RCE).
3. **CVE-2026-47876 (ESX):** An out-of-bounds write in the VMXNET3 adapter. This is characterized as a **Virtual Machine Escape**, where an attacker with admin rights on a guest VM can execute code on the underlying ESX host.
## Exploitation
- **Status:** Not currently exploited in the wild; no public PoC mentioned.
- **Complexity:** Low to Medium (vCenter flaws require network access; VM escape requires local admin on a guest).
- **Attack Vector:**
- **Network:** CVE-2026-59309 and CVE-2026-59310
- **Local:** CVE-2026-47876 (Guest-to-Host escape)
## Impact
- **Confidentiality:** High (Full access to vCenter or Host)
- **Integrity:** High (Ability to modify configurations or execute code)
- **Availability:** High (Potential for system-wide DoS)
## Remediation
### Patches
* **vCenter / vSphere:** Update to 9.1.0.0300, 9.0.2.0100, or 8.0 U3k.
* **ESX Hosts:** Apply versions ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, or ESXi80U3k-25595708.
* **Cloud Foundation:** Apply async patches for 5.x or upgrade to 9.x branched fixes.
* **Workstation/Fusion:** Upgrade to version 26H1.
### Workarounds
* Restrict network access to vCenter management interfaces to trusted IP addresses only.
* Audit the use of VMXNET3 adapters and ensure local administrative privileges on guest VMs are strictly controlled.
## Detection
- **Indicators of Compromise:** Monitor vCenter logs for unexpected authentication successes or unauthorized directory traversal attempts.
- **Detection methods:** Check VMware ESX host logs for VMXNET3 driver errors or crashes which may indicate exploitation attempts. Audit for unauthorized operations performed by "Administrator" accounts that lack corresponding log entries (related to CVE-2026-41709).
## References
- **Vendor Advisory:** hxxps://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- **VCF Guidelines:** hxxps://github[.]com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006
- **Source Article:** hxxps://thehackernews[.]com/2026/07/three-critical-vmware-flaws-allow-auth.html