Broadcom has released emergency security updates for several VMware products after identifying multiple vulnerabilities that carry critical severity. Among them are VMware critical flaws that could allow attackers to bypass authentication, execute arbitrary code, or even escape from a virtual machine to the underlying ESX host.
Broadcom also states there is no evidence indicating these issues have been exploited in the wild. Still, the company stresses that there are no available workarounds—so organizations should patch immediately to reduce exposure.
Why these VMware critical flaws matter
The updated issues impact widely used components across virtualization environments, including VMware ESX, vCenter, Workstation, and Fusion. The highest impact problems can be triggered by attackers with network access to vCenter, while another critical item involves code execution in a way that can lead to a VM escape.
Because the fixes are classified as emergency changes, delaying updates may increase the chance of attempted compromise, even if public exploitation is not yet confirmed.
CVE-2026-59309: authentication bypass in vCenter
One of the critical findings is CVE-2026-59309 (CVSS score: 9.8). Broadcom describes it as an authentication bypass in VMware vCenter.
In practical terms, Broadcom warns that a malicious actor with network access to vCenter could exploit the flaw to bypass authentication and gain unauthorized access.
What this means for defenders
If you manage vCenter, this is the kind of weakness that can turn a normally protected management interface into an entry point. That makes patching vCenter a priority, along with confirming that administrative access controls and monitoring are functioning as expected.
CVE-2026-59310: directory traversal leading to code execution
The second critical issue is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in vCenter. Broadcom notes that attackers with network access may exploit it to execute arbitrary code.
Directory traversal bugs often allow a crafted request to access unexpected filesystem paths. In this case, Broadcom’s characterization indicates the impact extends beyond file access and reaches code execution.
Security impact
When an attacker can execute code, the risk goes beyond the vCenter application itself. It can enable follow-on actions such as changing configurations, manipulating services, or staging further attacks inside the virtual infrastructure.
Where Broadcom says the critical fixes are available
Broadcom lists multiple version-specific fixes and mentions that certain VMware environments require asynchronous patching.
The two vCenter-related critical issues (CVE-2026-59309 and CVE-2026-59310) are addressed in these versions:
- VMware Cloud Foundation and VMware vSphere Foundation versions 9.1.x.x (fixed in 9.1.0.0300)
- VMware Cloud Foundation and VMware vSphere Foundation versions 9.0.x.x (fixed in 9.0.2.0100)
- VMware vCenter version 8.0 (fixed in 8.0 U3k)
- VMware Cloud Foundation versions 5.x (async patch to 8.0 U3k)
Because management plane components are the focus here, administrators should verify which vCenter build they run and align upgrades with the versions Broadcom indicates.
Additional patched vulnerabilities in ESX, Workstation, and Fusion
Beyond the two vCenter critical issues, Broadcom also patched three other vulnerabilities affecting VMware ESX and related products. These include a critical escape scenario and other memory-safety and logging concerns.
CVE-2026-47876: out-of-bounds write and virtual machine escape
CVE-2026-47876 (CVSS score: 9.3) is described as an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter of VMware ESX.
Broadcom says that a malicious actor with local administrative privileges inside a virtual machine that uses VMXNET3 could execute code on the ESX host. Broadcom also characterized this as a virtual machine escape, which is among the most serious categories of virtualization flaws.
Broadcom reports fixes in:
- VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0200-25557999
- VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.0.2.0100-25595025
- VMware ESX ESXi80U3k-25595708
CVE-2026-41703: out-of-bounds read with potential info disclosure or DoS
CVE-2026-41703 (CVSS score: 7.6) is an out-of-bounds read vulnerability in VMware ESX. Broadcom notes exploitation may be possible by a malicious actor with VM deployment privileges.
The potential outcomes include information disclosure or triggering a denial-of-service (DoS) condition. On VMware Workstation and Fusion, Broadcom reports the impact is limited to information disclosure.
Fixes include:
- VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0-25370933
- VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.0.2.0100-25595025
- VMware ESX ESXi80U3i-25205845
- VMware Workstation 26H1
- VMware Fusion 26H1
- VMware Cloud Foundation 5.2.3
CVE-2026-41709: insufficient logging in ESX
CVE-2026-41709 (CVSS score: 2.7) is categorized by Broadcom as an insufficient logging issue in VMware ESX.
Broadcom indicates that a malicious administrator could exploit this weakness to perform certain operations without generating the expected logs. Even though the CVSS score is lower, reduced visibility can increase dwell time for attackers.
Broadcom says the fix is available in:
- VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0-25370933
- VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.0.2.0100-25595025
- VMware ESX ESXi80U3j-25429389
No workarounds and an emergency change notice
Broadcom emphasizes that it found no evidence suggesting these vulnerabilities are being exploited in real-world environments. However, it also states there are no available workarounds. In security practice, that usually means mitigations alone cannot address the root cause.
The company’s emergency change classification signals that administrators should plan updates with urgency, validate compatibility, and apply the patched releases to all affected components in a controlled manner.
Recommended next steps for VMware administrators
To respond effectively to these VMware critical flaws, consider the following actions:
- Inventory your environment: identify every affected product (vCenter, ESX, Workstation, Fusion, and any VMware Cloud Foundation/vSphere Foundation components) and determine exact versions.
- Prioritize vCenter patching: CVE-2026-59309 and CVE-2026-59310 involve network-access attack paths and can lead to unauthorized access or code execution.
- Patch ESX hosts promptly: address CVE-2026-47876 to reduce VM escape risk associated with the VMXNET3 adapter.
- Verify logging and monitoring: ensure detection tooling is aligned, especially for the logging-related issue CVE-2026-41709.
- Track patch completion: document which systems are updated to the versions Broadcom lists and confirm post-update health.
Bottom line
Broadcom’s emergency updates close multiple security gaps across the VMware ecosystem, including VMware critical flaws that can bypass authentication, enable directory traversal into code execution, and even allow a virtual machine escape to the ESX host. Even without confirmed in-the-wild exploitation, the absence of workarounds makes prompt patching the safest course.
Source: https://thehackernews.com/2026/07/three-critical-vmware-flaws-allow-auth.html
