Critical VMware Flaws Let Attackers Bypass Authentication, Access Systems

Key Takeaways

• Broadcom has issued a critical security advisory (VMSA-2026-0006) for multiple severe vulnerabilities in VMware’s virtualization products.
• The most critical flaws, rated 9.8 CVSSv3, enable authentication bypass and arbitrary code execution in vCenter Server.
• Other significant vulnerabilities include a VM escape leading to host-level code execution in ESX (CVSSv3 9.3) and information disclosure risks in ESX, Workstation, and Fusion.
• A broad spectrum of products is affected, including vCenter, ESX, Workstation, Fusion, Cloud Foundation, and Telco Cloud offerings.
• Patches and updates are available and should be applied immediately to mitigate these high-impact risks.

Major Vulnerabilities Uncovered in VMware Ecosystem

Broadcom has released a critical security advisory, VMSA-2026-0006, detailing several high-severity vulnerabilities impacting a wide array of VMware virtualization platforms. These flaws, with CVSSv3 scores ranging from 2.7 to 9.8, could allow attackers to bypass authentication, execute arbitrary code, and gain unauthorized access to critical systems, including vCenter, ESX, Workstation, and Fusion.

The vulnerabilities span various components, from the vCenter Server’s Directory Service and Syslog server to the VMXNET3 virtual network adapter in ESX. The potential for exploitation poses a significant threat to virtualized environments across enterprise, cloud, and telecommunications sectors.

Critical Authentication Bypass and Code Execution in vCenter

The most severe vulnerability, identified as CVE-2026-59309, is an authentication bypass flaw residing within the VMware Directory Service used by vCenter Server. This critical vulnerability, boasting a CVSSv3 score of 9.8, permits an attacker with network access to vCenter to completely circumvent authentication. Such unauthorized access to the management plane grants full control over the virtual infrastructure, associated data, and all connected workloads.

Another critical issue, CVE-2026-59310 (also rated 9.8 CVSSv3), is a directory traversal vulnerability found in the vCenter Syslog server. By exploiting this flaw, a remote attacker with network access can execute arbitrary code. This exploit could establish vCenter as a pivot point for lateral movement and further compromise within the data center, making it an extremely dangerous entry vector.

ESX Host Compromise and VM Escape

A significant vulnerability affecting VMware ESX, CVE-2026-47876, carries a critical CVSSv3 score of 9.3. This flaw is an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. If an attacker gains local administrative privileges within a guest virtual machine utilizing the VMXNET3 adapter, they could trigger this vulnerability to execute code directly on the underlying ESX host, effectively escaping the virtual machine’s boundaries and compromising the host system.

Further vulnerabilities affecting ESX, Workstation, and Fusion include CVE-2026-41703 and CVE-2026-41709. CVE-2026-41703 is an out-of-bounds read vulnerability that can lead to information disclosure or denial-of-service for the host process. While rated 7.6 CVSSv3 for ESX, its impact is limited to information disclosure on Workstation and Fusion, where it holds a 2.7 CVSSv3 score. CVE-2026-41709, a low-severity issue (2.7 CVSSv3), points to insufficient logging on ESX, allowing administrators to perform certain operations without generating audit trails, thereby reducing accountability and visibility.

The advisory covers a broad range of VMware and Broadcom platforms, including VMware ESX, vCenter Server, Workstation, Fusion, VMware Cloud Foundation and vSphere Foundation, and VMware Telco Cloud Platform and Telco Cloud Infrastructure. This extensive list underscores the wide-reaching potential impact on organizations’ attack surfaces.

Patch Availability and Remediation

Broadcom has released patches and updates across all supported versions of the affected products. For vCenter, fixes are available in Cloud Foundation and vSphere Foundation 9.1.x.x and 9.0.x.x, standalone vCenter 8.0 (8.0 U3k), and Cloud Foundation 5.x via async patches aligned to vCenter 8.0 U3k. Specific versions to target include vCenter 9.1.0.0300 and 9.0.2.0100.

For ESX, critical fixes for VMXNET3 and other issues are available in ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708, ESXi80U3i-25205845, and Cloud Foundation 5.x releases 5.2.3 and 5.2.4. Telco-specific updates are referenced in Broadcom KB449886.

Workstation and Fusion users affected by CVE-2026-41703 can remediate the vulnerability by upgrading from version 25H2 to 26H1, mitigating the risk of information disclosure through local exploitation.

What You Should Do

• Immediately Patch vCenter: Prioritize updating all vCenter Server instances, especially those accessible from internal or external networks, to the latest patched versions (e.g., 9.1.0.0300, 9.0.2.0100, 8.0 U3k).
• Update ESX Hosts: Apply patches for ESX hosts, particularly those utilizing the VMXNET3 virtual network adapter, to address the critical VM escape vulnerability.
• Upgrade Workstation and Fusion: Users of VMware Workstation and Fusion should upgrade from version 25H2 to 26H1 to mitigate information disclosure risks.
• Review Logging Policies: After applying updates for CVE-2026-41709, review and ensure that all administrative operations on ESX are properly logged to maintain auditability and visibility.
• Consult Broadcom Advisory: Refer to the official Broadcom VMSA-2026-0006 advisory for specific version matrices and detailed patching instructions relevant to your environment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.