ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Tencent Xuanwu Lab

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Broadcom patched two VMware Workstation and Fusion flaws, including critical integer overflow CVE-2026-59346 (CVSS 9.3), letting guest admins execute host code; no exploitation seen.

Broadcom released updates fixing CVE-2026-59346 (CVSS 9.3), an integer-overflow vulnerability allowing a malicious actor with local administrative privileges on a VM with a VMXNET3 adapter to execute code on the host, and CVE-2026-59347 (CVSS 8.1), a stack-based buffer overflow in HGFS allowing code execution as the host's VMX process. Both flaws affect VMware Workstation and Fusion 25H2 and 26H1, have no workarounds, and are fixed in Workstation 26H1u1 and Fusion 26H1u1. No in-the-wild exploitation has been observed, though VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310, the latter suspected of China-nexus APT use, have recently breached 361 unique victim IPs across 47 countries.

The Hacker News · 10d agoVulnerabilityCVE-2026-59346CVE-2026-59347CVE-2026-59309+1 CVEs

Related CVEs

  • CVE-2026-593109.846%
    Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
    CVE-2026-59310 is a directory traversal (CWE-22) vulnerability in the Syslog server component of VMware vCenter Server, rated critical at CVSS 9.8. It can be triggered over the network without authentication or user interaction, allowing a malicious actor with network access to vCenter to achieve arbitrary code execution. An attacker who exploits it gains code execution on the vCenter appliance, and reported campaigns show it has been used to establish persistent remote access and, by a suspected China-nexus actor, to deploy Babuk ransomware. Any organization running an affected version of vCenter Server is exposed, especially where the management interface is reachable from the internet; the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18, it was reportedly exploited just five days after disclosure, and EPSS estimates a 45.9% probability of exploitation within 30 days (99th percentile).
    · Broadcom (VMware) vCenter Server KEV ransomwarelarge
  • CVE-2026-593099.88%
    VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service.
    VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.
    · vmware vcenter server—
  • CVE-2026-59347——
    —
  • CVE-2026-59346——
    PoC —

Appears with

organization Broadcom 1organization Tencent 1product VMware Fusion 1product VMware Workstation 1vendor Broadcom 1vendor VMware 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.