VMware fixes: critical auth bypass and VM escapes

Broadcom has released security updates for various VMware products, including vCenter, ESX/ESXi, Workstation, and Fusion. In total, there are five vulnerabilities, three of which are classified as critical. In particular, the VMware kritieke auth bypass is alarming, because an attacker can force access to a vCenter system without authentication.

In addition, the updates include fixes for issues that could allow arbitrary code execution and a flaw that can lead to escaping from a virtual machine to the host. Broadcom treats these improvements as emergency fixes: organizations with versions before the patched releases mentioned in the advisory are advised to take action immediately.

Which vulnerabilities are most urgent?

Of the five issues, three are critical. They target different parts of VMware and require different levels of access. Below are the key points from the released information.

1) Authentication bypass via VMware Directory Service (CVE-2026-59309)

The first critical vulnerability is an authentication bypass in the VMware Directory Service. An attacker with network access to vCenter can bypass security controls without logging in and gain unauthorized access to the system.

This is exactly the type of problem organizations struggle with most: once the environment is taken over, the impact can quickly shift toward sensitive systems and data.

2) Directory traversal in vCenter Syslog leads to code execution (CVE-2026-59310)

The second critical issue involves directory traversal in the vCenter Syslog server. Again, the scenario is the same: an unauthenticated attacker with network access can exploit the flaw to execute arbitrary code.

That makes the vulnerability not only an access problem, but also a pathway to further compromise of the management layer.

3) VMXNET3 out-of-bounds write: possible VM escape (CVE-2026-47876)

The third critical vulnerability concerns an out-of-bounds write in the VMXNET3 virtual network adapter. If an attacker has local administrator privileges inside a virtual machine, they can execute code on the ESX host. The result could be a virtual machine escape.

VMs that use different network adapters are not affected by this specific flaw. Broadcom does warn, however, that “omitting” VMXNET3 as a mitigation is not considered a sensible approach, because other adapters may also contain security issues according to the advisory, and doing so could affect performance.

Other patches: information leak and logging issues

Besides the critical fixes, there are two lower-severity points to note, and one additional vulnerability affecting logging.

• CVE-2026-41703: an out-of-bounds read in ESX, Workstation, and Fusion. With the right privileges, this can lead to information disclosure or (on ESX) a denial-of-service. On Workstation and Fusion, the impact remains limited to information leaks.
• CVE-2026-41709: an insufficient logging issue in ESX, where a malicious ESX administrator can perform certain actions without them being properly recorded.

While less critical than the auth bypass and the VM escape, these are the types of shortcomings that often only become visible later. Incomplete logging can make detection harder, while information leaks can help enable further attacks.

Which VMware environments are affected?

The updates are not limited to standalone installations. Broadcom states that products or environments with vCenter or ESX are also affected, including:

• VMware Cloud Foundation
• VMware vSphere Foundation
• VMware Telco Cloud Platform
• VMware Telco Cloud Infrastructure

For organizations, this means: don’t only look at the direct versions of vCenter/ESXi, but also how platform components are integrated into your cloud foundation or telco setup.

Available fix versions and patch guidance

Broadcom lists specific patched versions for the vCenter and ESX-related components.

• vCenter fixes are available in versions 9.1.0.0300, 9.0.2.0100, and 8.0 Update 3k.
• ESX/ESXi fixes are available in ESXi 9.1.0.0200, ESXi 9.0.2.0100, and ESXi 8.0 Update 3k.

For VMware Workstation and Fusion, Broadcom indicates that anyone using version 25H2 must upgrade to 26H1 to remediate CVE-2026-41703.

In addition, Broadcom says there are no workarounds. This makes the choice to “delay until later” even riskier, especially because there are no indications that the attacks are already occurring in the wild, although VMware infrastructure is generally targeted regularly.

Availability impact: what to expect during rollout

Broadcom indicates that patching may temporarily affect services. Patching vCenter temporarily interrupts access to the vSphere Client and other management interfaces, according to the guidance. Virtual machines and containers typically continue running as usual.

For ESX/ESXi updates, a server reboot is usually required. Broadcom advises moving virtual machines with vMotion while updating clusters step-by-step via a rolling reboot. If migration is not possible, the relevant virtual machines must be powered off during the restart.

Additionally, supported environments can use ESX Live Patch to reduce disruption. For vCenter updates, this is not eligible for Quick Patch.

Attention: compatibility warning for Cloud Foundation

Alongside the technical impact, there is an important consideration for VMware Cloud Foundation upgrades. Broadcom points to a potential compatibility issue when upgrading if the patch updates a product branch to a higher build number than the target version you plan to upgrade to later.

In that case, a “back in time” message may occur, which blocks the upgrade. Broadcom states that this is fixed in later releases.

Practical approach: patch quickly, test in a controlled way

Even though Broadcom does not see exploitation in the wild for this specific advisory, the reasoning behind the urgency is clear: attacks against vCenter or ESXi can provide broad access across a large portion of server and data environments.

Therefore, plan a rollout with a clear sequence: first inventory (which versions, which adapters, which platform components), then patch according to the listed fix versions, and finally test across multiple layers. Consider management connectivity, migration/vMotion flow, and logging/monitoring after the update—especially because the set of vulnerabilities also relates to logging.

This reduces the chance that a critical VMware kritieke auth bypass or a possible VM escape reaches your environment, while keeping operational impact under control.