CVE-2026-47876

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 0.19%
EPSS Percentile: 8.75%
CISA KEV: Not listed

Description

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 30-Jul-2026 20:16
Last Modified: 30-Jul-2026 21:16
EPSS Date: 2026-10-25
CWE: CWE-787

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

[email protected]

Last enrichment sync: 26-Oct-2026 18:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2026-47876 can let an attacker escape from a VM to the ESX host via VMXNET3. Broadcom Patches Five VMware Flaws, Including VM Escape and Authentication Bypass
CVE-2026-47876 is an out-of-bounds write in VMXNET3 that may allow code execution on the ESX host. Broadcom Patches VMware Flaws That Could Enable Authentication Bypass and Code Execution

CVE (4)

Malware (1)

MITRE ATT&CK (2)

Vendors (2)

Products (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.