Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom patched two VMware Workstation and Fusion flaws, including critical integer overflow CVE-2026-59346 (CVSS 9.3), letting guest admins execute host code; no exploitation seen.
Broadcom released updates fixing CVE-2026-59346 (CVSS 9.3), an integer-overflow vulnerability allowing a malicious actor with local administrative privileges on a VM with a VMXNET3 adapter to execute code on the host, and CVE-2026-59347 (CVSS 8.1), a stack-based buffer overflow in HGFS allowing code execution as the host's VMX process. Both flaws affect VMware Workstation and Fusion 25H2 and 26H1, have no workarounds, and are fixed in Workstation 26H1u1 and Fusion 26H1u1. No in-the-wild exploitation has been observed, though VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310, the latter suspected of China-nexus APT use, have recently breached 361 unique victim IPs across 47 countries.
- CVE-2026-59346 (CVSS 9.3): integer overflow lets guest admins execute host code via the VMXNET3 virtual network adapter.
- CVE-2026-59347 (CVSS 8.1): HGFS stack buffer overflow allows code execution as the VMX process on the host.
- Fixed in Workstation 26H1u1 and Fusion 26H1u1; affects 25H2 and 26H1; no workarounds available.
- No in-the-wild exploitation yet, but VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310 are actively exploited, hitting 361 IPs in 47 countries.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system. NVD description · AI analysis pending | 9.8 | 8% |
| — | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog CVE-2026-59310 is a directory traversal (CWE-22) vulnerability in the Syslog server component of VMware vCenter Server, rated critical at CVSS 9.8. It can be triggered over the network without authentication or user interaction, allowing a malicious actor with network access to vCenter to achieve arbitrary code execution. An attacker who exploits it gains code execution on the vCenter appliance, and reported campaigns show it has been used to establish persistent remote access and, by a suspected China-nexus actor, to deploy Babuk ransomware. Any organization running an affected version of vCenter Server is exposed, especially where the management interface is reachable from the internet; the available data does not specify affected version ranges. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-18, it was reportedly exploited just five days after disclosure, and EPSS estimates a 45.9% probability of exploitation within 30 days (99th percentile). Do: Upgrade vCenter Server to the patched release identified in Broadcom's advisory (no specific version ranges are provided in this data) and prioritize any vCenter that is internet-facing, in line with CISA KEV and BOD 26-04 requirements for federal agencies. Until patched, restrict access to the vCenter management interface to trusted networks and verify whether the vCenter Syslog server is enabled. Hunt for compromise indicators, including unexplained remote-access persistence and Babuk ransomware artifacts, given the documented China-nexus exploitation. | 9.8 | 46% | KEV ransomware |
| largeApproximately 50,000-100,000 internet-exposed vCenter Server instances, with total deployments (including internal-only) likely in the hundreds of thousands | |
| CVE-2026-59346 | NVD description · AI analysis pending | — | — | PoC | — | — | — |
| CVE-2026-59347 | NVD description · AI analysis pending | — | — | — | — | — |
Full article366 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 05, 2026Vulnerability / Server Security
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions.
The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code.
"A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host," Broadcom said in an alert.
The tech giant credited @h4urek, @cameudis, and Stan S for discovering the issue.
Also patched by Broadcom is a stack-based buffer-overflow vulnerability in HGFS (CVE-2026-59347, CVSS score: 8.1), which can be exploited by a bad actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab have been acknowledged for reporting the flaw.
In both cases, successful exploitation hinges on an attacker already possessing local administrative privileges, although it's worth noting that they can be obtained through a separate compromise through phishing or exploiting weak user configurations.
The two vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1. Broadcom said there are no workarounds that address the two vulnerabilities, adding that they have been patched in VMware Workstation 26H1u1 and VMware Fusion 26H1u1.
Although there is no evidence that the security flaws have been exploited in the wild, vulnerabilities in VMware products have been an attack magnet.
As recently as last month, threat actors were observed actively exploiting two shortcomings in VMware vCenter, namely CVE-2026-59309 and CVE-2026-59310, with the latter suspected to be weaponized by a China-nexus advanced persistent threat (APT) actor.
The activity, which started five calendar days after public disclosure of the flaw, is estimated to have breached 361 unique victim IP addresses across 47 countries. Most of the infections were concentrated in Germany (55), the U.S. (41), Turkey (38), Iran (26), and France (25).
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html