Loading story…
Broadcom released advisory VMSA-2026-0007 addressing two vulnerabilities in VMware Workstation and VMware Fusion for macOS that permit code execution on the host from a privileged guest. CVE-2026-59346, a VMXNET3 integer overflow rated CVSSv3 9.3, allows an attacker with local administrative privileges in a suitably configured virtual machine to execute code on the host. CVE-2026-59347, an HGFS stack-based buffer overflow rated CVSSv3 8.1, allows a guest administrator to execute code in the context of the virtual machine’s VMX process on the host.
Broadcom identifies versions 25H2 and 26H1 as affected and fixes both flaws in 26H1u1, with no workarounds listed. The Canadian Centre for Cyber Security and Guyana National CIRT issued notices urging users and administrators to review the advisory and apply the updates. Organizations should identify affected installations and prioritize upgrading to 26H1u1, particularly where guests are administered by untrusted users. The supplied notices do not report active exploitation.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued notice AV26-1008 concerning the two vulnerabilities affecting VMware Workstation and Fusion for macOS. It directed users and administrators to review the linked advisories and apply necessary updates.
The Zero Day Initiative published an advisory for CVE-2026-59346, assigning it a CVSS score of 7.5 and assessing that exploitation could allow arbitrary code execution in the hypervisor context.
On September 3, 2026, Broadcom published critical advisory VMSA-2026-0007 covering CVE-2026-59346 and CVE-2026-59347, which can allow privileged guest attackers to execute code on the host or as its VMX process. The advisory identifies Workstation and Fusion versions 25H2 and 26H1 as affected, lists 26H1u1 as fixing both vulnerabilities, and provides no workarounds.
0xCyberstan released a public GitHub proof of concept for CVE-2026-59346 that triggers an integer overflow in VMXNET3 TCP Segmentation Offload processing. Requiring administrative privileges inside a guest VM, the PoC demonstrates memory corruption and a vmware-vmx crash that powers off the affected VM, rather than successful guest-to-host code execution.
Guyana National CIRT published a notice referencing VMSA-2026-0007 and Canadian advisory AV26-1008, listing VMware Workstation and Fusion for macOS versions prior to 26H1u1 as affected. It recommended reviewing the updates and applying them where necessary.
Researchers independently reported the VMXNET3 integer-overflow vulnerability CVE-2026-59346 and the HGFS stack-based buffer-overflow vulnerability CVE-2026-59347 to Broadcom. Broadcom credited researchers associated with secsys lab, TrendAI Zero Day Initiative, and Tencent Xuanwu Lab.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
socprime.com
Open sourcethecybersecguru.com
Open sourcethreataft.com
Open sourcecybersecuritynews.com
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourcesupport.broadcom.com
Open sourcesupport.broadcom.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom patched two vulnerabilities in VMware Workstation and Fusion that allow an attacker with local administrator privileges in a guest virtual machine to execute code on its host. **CVE-2026-59346** is a critical (CVSS 9.3) integer-overflow vulnerability in the VMXNET3 virtual network adapter, while **CVE-2026-59347** is a high-severity (CVSS 8.1) stack-based buffer overflow in the Host-Guest File System (HGFS) that can execute code in the VM's host-side VMX process. The flaws affect VMware Workstation and Fusion versions 25H2 and 26H1 and are fixed in version **26H1u1** under advisory `VMSA-2026-0007`. Broadcom said no workarounds are available, making prompt upgrades necessary for affected environments. The vulnerabilities were privately reported, with no indication of exploitation in the wild.
Sep 10, 2026
Broadcom released fixes for three actively exploited VMware zero-day vulnerabilities affecting **ESXi**, **Workstation**, and **Fusion**, warning that the bugs can be chained to achieve a full virtual machine escape from a guest system to the hypervisor. The flaws, tracked as `CVE-2025-22224`, `CVE-2025-22225`, and `CVE-2025-22226`, include a critical issue and can enable code execution, sandbox escape, and access to sensitive memory when an attacker already has administrative privileges inside a guest VM. Microsoft Threat Intelligence Center reported the in-the-wild exploitation, and security researchers described the campaign as **ESXicape**. Affected products include unpatched **VMware ESXi 7.0 and 8.0**, **VMware Workstation 17.x before 17.6.3**, and **VMware Fusion 13.x before 13.6.3**. Organizations running VMware Cloud Foundation environments may need to account for Broadcom’s product-specific patching requirements and compatibility constraints when deploying updates, including cases where some component updates are handled through the in-product Flexible BOM rather than the Async Patch Tool. Defenders are being urged to apply the relevant ESXi patches immediately and upgrade desktop hypervisor products to the fixed releases to block guest-to-host compromise.
Jul 24, 2026
Broadcom released **VMSA-2026-0006** to patch five vulnerabilities affecting **VMware vCenter, ESXi, Workstation, and Fusion**, including three critical flaws. The most severe issues are **`CVE-2026-59309`** and **`CVE-2026-59310`**, both rated **CVSS 9.8**, which can be exploited remotely against **vCenter** by an unauthenticated attacker with network access to bypass authentication or achieve remote code execution. Broadcom said there are **no workarounds** and urged organizations to prioritize patching, particularly for externally reachable or broadly accessible vCenter deployments. The advisory also fixes **`CVE-2026-47876`**, a critical **VM escape** in ESXi’s **VMXNET3** virtual network adapter that could let an attacker with local administrative privileges inside a guest VM execute arbitrary code on the ESXi host. Two additional flaws were patched: **`CVE-2026-41703`**, a high-severity issue affecting ESXi, Workstation, and Fusion that can cause information disclosure or, more likely, denial of service, and **`CVE-2026-41709`**, a low-severity ESXi logging-related bug. Broadcom said it is **not aware of in-the-wild exploitation** and published patching guidance and an FAQ for affected customers.
Aug 3, 2026