60
55
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
Broadcom issued emergency updates for VMware ESX, vCenter, Workstation and Fusion, fixing five flaws including CVE-2026-59309 (CVSS 9.8 authentication bypass in vCenter) and CVE-2026-59310 (CVSS 9.8 directory traversal allowing code execution). CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the ESX VMXNET3 adapter that permits a virtual machine escape to the host. Broadcom found no evidence of exploitation, but Defused Cyber reported a spike in vCenter scanning on August 11, 2026 consistent with exploitation attempts against CVE-2026-59309 (VMSA-2026-0006). No workarounds are available.
80
30
30
55
60
55
60
60
60
30
60
35
60
Broadcom Issues Patches for VMware NSX and vCenter Security Flaws
60
60
60
55
60
30
60
30
60
Recently disclosed VMware vCenter Server bugs are actively exploited in attacks
60
60
60
60
60
60
30
60
60
60
60
60
35
July 2021 Patch Tuesday: Microsoft fixes 4 actively exploited bugs
60
60
VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi
60