Full Report
Broadcom has released security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. [...]
Analysis Summary
# Vulnerability: Multiple Critical Flaws in VMware vCenter, ESX, Workstation, and Fusion
## CVE Details
- **CVE ID:** CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709
- **CVSS Score:** 9.8 (Critical) for vCenter flaws; 9.3 (Critical) for ESX escape
- **CWE:**
- CVE-2026-59309: Authentication Bypass
- CVE-2026-59310: Path Traversal (CWE-22)
- CVE-2026-47876: Out-of-bounds Write (CWE-787)
- CVE-2026-41703: Out-of-bounds Read (CWE-125)
## Affected Systems
- **Products:**
- VMware vCenter Server
- VMware ESXi
- VMware Workstation Pro / Player
- VMware Fusion
- VMware Cloud Foundation, vSphere Foundation, Telco Cloud Platform/Infrastructure
- **Versions:** All versions prior to the fixed releases listed in remediation.
- **Configurations:**
- **CVE-2026-47876:** Only affects VMs specifically configured with the **VMXNET3** virtual network adapter.
- **CVE-2026-41703:** Requires VM deployment privileges on ESXi; local access on Workstation/Fusion.
## Vulnerability Description
Broadcom addressed five vulnerabilities, three of which are critical:
1. **CVE-2026-59309 (vCenter):** A flaw in the VMware Directory Service allowing unauthenticated network actors to bypass authentication.
2. **CVE-2026-59310 (vCenter):** A directory traversal vulnerability in the Syslog server enabling unauthenticated Remote Code Execution (RCE).
3. **CVE-2026-47876 (ESXi):** An out-of-bounds write in the VMXNET3 adapter. A local administrator within a guest VM can trigger this to execute code on the underlying ESXi host (VM Escape).
4. **CVE-2026-41703 (ESXi/Workstation/Fusion):** Out-of-bounds read leading to Information Disclosure or DoS on the host.
5. **CVE-2026-41709 (ESXi):** Insufficient logging allowing admins to hide specific operations.
## Exploitation
- **Status:** Not currently exploited in the wild; no public PoC reported yet.
- **Complexity:** Low (vCenter flaws); Medium (VM Escape requires local admin in guest).
- **Attack Vector:**
- Network (CVE-2026-59309, CVE-2026-59310)
- Local (CVE-2026-47876, CVE-2026-41703)
## Impact
- **Confidentiality:** Critical (Full system access/Information disclosure)
- **Integrity:** Critical (Arbitrary code execution)
- **Availability:** Critical (Total system compromise/DoS)
## Remediation
### Patches
Update to the following versions or newer:
- **vCenter Server:** 9.1.0.0300, 9.0.2.0100, or 8.0 Update 3k.
- **ESXi:** 9.1.0.0200, 9.0.2.0100, or 8.0 Update 3k.
- **Workstation/Fusion:** Upgrade from 25H2 to version **26H1**.
- **VMware Cloud Foundation:** Refer to specific vendor instructions regarding "back in time" upgrade restrictions.
### Workarounds
- **No official workarounds provided.**
- Broadcom explicitly advises **against** switching from VMXNET3 to other adapters due to potential performance degradation and existing flaws in alternative adapters.
## Detection
- **Indicators of Compromise:** Monitor vCenter Directory Service logs for unusual authentication patterns and Syslog traffic for path traversal sequences (e.g., `../`).
- **Detection methods:** Audit ESXi host processes for unexpected crashes or unauthorized administrative actions that bypass standard logging (CVE-2026-41709). Utilize `vMotion` to clear hosts for patching and monitor for "ghost" VMs that do not appear in management consoles.
## References
- **Vendor Advisory:** [https://www.broadcom.com/support/advisories] (General link)
- **Supplemental FAQ:** hxxps[://]github[.]com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006
- **BleepingComputer Report:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/vmware-fixes-three-critical-flaws-allowing-auth-bypass-vm-escapes/