VMware fixes three critical flaws: vCenter auth bypass and VM escape
by Claudiu Hulea · IT Management Consultant
Broadcom has shipped patches for several VMware flaws, three of them critical: two in vCenter — an authentication bypass and a code execution flaw, both scoring CVSS 9.8 and exploitable without authentication — and a virtual-machine escape (VM escape, CVSS 9.3). The good news: they are not yet exploited in the wild, and patches are available. The less good news: there is no workaround. Below: what they are, and in what order to update.
In brief
- Three critical flaws, plus two low-severity ones reported in the same advisory.
- vCenter is the most exposed: two CVSS 9.8 holes, over the network, without authentication.
- A VM escape via the VMXNET3 network adapter breaks the isolation between a virtual machine and its host.
- No confirmed exploitation in the wild at the time of the advisory.
- No mitigations — the only fix is to update.
The three critical flaws
- CVE-2026-59309 — authentication bypass (CVSS 9.8). Affects the VMware Directory Service in vCenter. An attacker with network access and no authentication can bypass access control. vCenter is the central console of the whole virtual infrastructure, so the impact is maximal.
- CVE-2026-59310 — code execution via directory traversal (CVSS 9.8). A weakness in vCenter’s Syslog server lets an unauthenticated, network-based attacker run arbitrary code.
- CVE-2026-47876 — VM escape (CVSS 9.3). An out-of-bounds write in the VMXNET3 network adapter lets code inside a virtual machine break out of its isolation. The condition: local admin rights inside the VM.
The advisory also includes two low-severity issues: CVE-2026-41703 (an out-of-bounds read with information-disclosure/DoS potential on ESX, Workstation and Fusion) and CVE-2026-41709 (insufficient logging for some ESX administrator operations).
Why vCenter matters this much
In a virtualized environment, vCenter is “the keys to the kingdom”: it is where every ESXi host and every virtual machine is administered. An authentication bypass exploitable over the network, without credentials, turns vCenter from a management point into a single point of failure — compromising it can mean control over the entire virtual estate, not a single machine.
The VM escape hits another fundamental guarantee: isolation. Companies run different workloads — sometimes different customers’ — on the same physical host, assuming a compromised VM cannot reach its neighbours. CVE-2026-47876 breaks exactly that assumption.
Affected products
The advisory covers a broad range: vCenter, ESX/ESXi, Workstation, Fusion, plus Cloud Foundation, vSphere Foundation and the Telco Cloud platforms. In practice, if you run VMware virtualization, you are probably in scope.
What to do
- Update vCenter, first. Fixed versions: 9.1.0.0300, 9.0.2.0100 and 8.0 Update 3k. The two 9.8 flaws live here.
- Update ESXi. Fixed versions: 9.1.0.0200, 9.0.2.0100 and 8.0 Update 3k.
- Update Workstation and Fusion to version 26H1.
- Do not switch the VMXNET3 adapter for another as a “temporary fix” — Broadcom explicitly advises against it, because the other adapters have had their own flaws. The correct fix is the patch.
- Until you patch, restrict network access to the vCenter management interface — it should never be exposed directly to the internet or to flat, unsegmented networks.
The fact that there is no exploitation yet is not a reason to delay — it is the window in which you have the advantage. After a patch ships, attackers reverse-engineer it to reconstruct the flaw; for critical holes, exploitation often appears within days.
If you are not sure which VMware versions you run, how exposed your vCenter interface is, or what your management-network segmentation looks like, a security audit gives you the inventory and a prioritized risk list, and a penetration test checks whether an attacker could actually reach these systems. Get in touch and we will look at it together.
Source: BleepingComputer.
Frequently asked questions
Are these flaws already being exploited?
No — as of the advisory, Broadcom reported no in-the-wild exploitation. But an unauthenticated, network-reachable vCenter auth bypass (CVSS 9.8) is exactly the kind of flaw attackers reverse-engineer from the patch and weaponise quickly. The patch window is short.
What is most urgent to update?
vCenter, first. The two critical 9.8 flaws are network-exploitable without authentication, and vCenter controls the entire virtual estate — compromising it means control over every VM it manages. ESXi and Workstation/Fusion come next.
What does a "VM escape" mean?
It is the scenario where code running inside a virtual machine breaks out of its isolation and reaches the hypervisor (the host) or other VMs. It breaks the very guarantee virtualization rests on: that a compromised VM stays contained. CVE-2026-47876 needs local admin rights inside the VM, but in a multi-tenant environment the stakes are high.
Is there a workaround if I cannot patch immediately?
No — Broadcom published no mitigations, and for the VM escape it explicitly advises AGAINST switching away from the VMXNET3 adapter (the alternatives have their own history of flaws). The only real fix is the patch. Until then, restrict network access to the vCenter management interface.
