cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Broadcom Patches Five VMware Flaws, Including VM Escape and Authentication Bypass

· Original article ↗

Summary

Broadcom issued emergency patches for five VMware vulnerabilities, including critical flaws enabling vCenter authentication bypass, code execution, and a VM-to-ESX host escape. No workarounds or evidence of active exploitation were reported.

Key points

  • The flaws affect VMware vCenter, ESX, Workstation, and Fusion, as well as products that include vCenter or ESX.
  • CVE-2026-59309 enables unauthenticated authentication bypass in VMware Directory Service; CVE-2026-59310 enables code execution through the vCenter Syslog server.
  • CVE-2026-47876 can enable a VM escape through the VMXNET3 adapter; exploitation requires local administrative privileges inside the affected VM.
  • The other flaws involve information disclosure or denial of service (CVE-2026-41703) and insufficient logging (CVE-2026-41709).
  • Broadcom says there are no workarounds and no indication the vulnerabilities are being exploited in the wild; administrators should install the applicable updates promptly.
  • Patching can temporarily interrupt vCenter management access; ESX updates require a server restart, which can disrupt VMs that cannot be migrated.

Article Details

Vulnerability Types
  • Authentication bypass
  • Directory traversal
  • Out-of-bounds write
  • Out-of-bounds read
  • Insufficient logging
Severity
Three vulnerabilities are rated Critical: CVE-2026-59309 and CVE-2026-59310 have CVSS scores of 9.8, and CVE-2026-47876 has a score of 9.3.
Affected Versions
  • VMware Workstation 25H2
  • VMware Fusion 25H2
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationCVE-2026-47876 can let an attacker with local administrative privileges inside a VM execute code on the ESX host, escaping the virtual machine.T1210 · Exploitation of Remote ServicesThe article says an unauthenticated attacker with network access to vCenter can exploit CVE-2026-59309 to bypass authentication, and CVE-2026-59310 to execute arbitrary code.

CVE

CVE-2026-41703CVE-2026-41703: An out-of-bounds read vulnerability in ESX, Workstation, and Fusion.CVE-2026-41709CVE-2026-41709: An insufficient logging vulnerability that allows a malicious ESX administrator to perform certain operations without them being logged.CVE-2026-47876CVE-2026-47876 can let an attacker escape from a VM to the ESX host via VMXNET3.CVE-2026-59309CVE-2026-59309 enables authentication bypass in VMware Directory Service.CVE-2026-59310CVE-2026-59310 allows arbitrary code execution through the vCenter Syslog server.

Malware

BRICKSTORM2025, CISA also warned that Chinese threat actors were compromising VMware vSphere servers to deploy BrickStorm malware, create hidden rogue virtual machines, and steal cloned virtual machine snapshots for

Vendors

BroadcomBroadcom has issued emergency patches for five VMware vulnerabilities affecting vCenter, ESX, Workstation, and Fusion, including three critical flaws that could let attackers bypass authentication, execute code, orVMwareBroadcom has issued emergency patches for five VMware vulnerabilities affecting vCenter, ESX, Workstation, and Fusion, including three critical flaws that could let attackers bypass authentication, execute code, or

Products

ESXBroadcom has issued emergency patches for five VMware vulnerabilities affecting vCenter, ESX, Workstation, and Fusion, including three critical flaws that could let attackers bypass authentication, execute code, orVMware Cloud FoundationAdministrators of VMware Cloud Foundation, VMware vSphere Foundation, and VMware Telco Cloud products should update immediately, as Broadcom says there are no workarounds and no evidence of active exploitation yet.VMware Telco Cloud InfrastructureThe vulnerabilities also affect products containing vCenter or ESX, including VMware Cloud Foundation, VMware vSphere Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure.VMware Telco Cloud PlatformThe vulnerabilities also affect products containing vCenter or ESX, including VMware Cloud Foundation, VMware vSphere Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure.VMware vCenterBroadcom fixed five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion.VMware vSphere FoundationAdministrators of VMware Cloud Foundation, VMware vSphere Foundation, and VMware Telco Cloud products should update immediately, as Broadcom says there are no workarounds and no evidence of active exploitation yet.VMWare WorkstationVMware Workstation and Fusion users running version 25H2 must upgrade to 26H1 to address CVE-2026-41703.

Related Articles