Broadcom has released patches for five vulnerabilities in VMware vCenter, ESXi, Workstation, and Cloud Foundation, including two rated CVSS 9.8 — the highest severity short of a perfect score. CVE-2026-59309 is an authentication bypass in vCenter that any network-reachable attacker can exploit without credentials to gain unauthorized access. CVE-2026-59310 is a directory traversal flaw in vCenter that lets an unauthenticated attacker execute arbitrary code remotely. Together, they represent a straightforward path for an external attacker to fully compromise a VMware vCenter server — the management plane for entire virtualisation stacks — without needing any foothold first.
The remaining three vulnerabilities add further risk for environments that are already partially compromised. CVE-2026-47876 (CVSS 9.3) is a VM escape: a local administrator inside a guest virtual machine can exploit an out-of-bounds write in the VMXNET3 network adapter to execute code on the ESXi host itself, breaking the isolation that virtualisation is supposed to provide. CVE-2026-41703 is an out-of-bounds read that can leak information or cause denial-of-service on Workstation and Fusion. CVE-2026-41709, rated low, allows privileged operations to occur without being logged. Broadcom says it has found no evidence of exploitation in the wild for any of these issues, giving organisations a window to patch before attackers weaponise them.
How to check if you’re affected
Affected versions of VMware products include vCenter Server 8.0 (all builds before 8.0 U3k) and 9.x, ESXi 8.x and 9.x, VMware Workstation and Fusion 26H1, and VMware Cloud Foundation 5.x and 5.2.3. Check your installed versions in the vSphere Client under Administration → Deployment → System Configuration, or via esxcli system version get on the ESXi CLI. Broadcom has published fixed builds for all affected product lines; apply the hot-patch or upgrade to the fixed build specified in the VMSA advisory. The two critical vCenter vulnerabilities (CVE-2026-59309 and CVE-2026-59310) require no authentication to exploit and should be treated as top priority.