Broadcom has shipped emergency security updates for VMware vCenter, ESXi, Workstation, and Fusion, patching five vulnerabilities — three of them critical. The most severe, CVE-2026-59309 and CVE-2026-59310 (both CVSS 9.8), affect vCenter: the first is an authentication bypass in the VMware Directory Service that lets an unauthenticated attacker with network access take control of vCenter without any credentials; the second is a directory traversal in the vCenter Syslog server that allows unauthenticated remote code execution. Together they mean an attacker who can reach vCenter over the network can own it without logging in.
The third critical flaw, CVE-2026-47876 (CVSS 9.3), is a virtual machine escape via the VMXNET3 virtual network adapter. An attacker with administrative access inside a guest VM using VMXNET3 can exploit an out-of-bounds write bug to run code on the underlying ESX host — breaking through the hypervisor boundary. Virtual machines using other network adapters are not affected by this specific flaw. Two lower-severity issues round out the advisory: an out-of-bounds read (CVE-2026-41703) that can leak host information or cause a denial-of-service on ESX, Workstation, and Fusion, and an insufficient-logging bug (CVE-2026-41709) that lets a rogue ESX administrator hide certain actions. Broadcom says there is no evidence of active exploitation, but vmware infrastructure is a perennial ransomware target and the company is treating these as emergency changes requiring immediate patching. There are no workarounds — patches must be applied.
How to check if you’re affected
Affected products include all versions of VMware vCenter, ESXi, Workstation, and Fusion released before the following fixed builds: vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 Update 3k; ESXi 9.1.0.0200, 9.0.2.0100, or 8.0 Update 3k; VMware Workstation and Fusion versions earlier than 26H1. Affected versions also include VMware Cloud Foundation 5.x, vSphere Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure — see Broadcom’s advisory for product-specific instructions. Patching vCenter temporarily interrupts access to the vSphere Client but does not stop running VMs. ESXi updates require a host reboot; use vMotion to migrate VMs first, or shut them down if migration is not possible.