Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape

Broadcom hasreleasedsecurity updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity.

The first of the three critical-rated flaws isCVE-2026-59309(CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter.

"A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system," Broadcom said.

The second critical flaw is a directory-traversal vulnerability in vCenter (CVE-2026-59310, CVSS score: 9.8) that a malicious actor with network access can exploit to execute arbitrary code. Both vulnerabilities have been addressed in the versions below -

Also patched by Broadcom are three other flaws -

Broadcom noted that it has found no evidence to suggest any of these issues have been exploited in the wild. The technology giant also characterized CVE-2026-47876 as a virtual machine escape.

"An attacker who already holds local administrative privileges inside a virtual machine that uses the VMXNET3 virtual network adapter may execute code on the ESX host," itsaid.

Cybersecurity Webinars

How to Secure AI Code Before It Reaches Production

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

How to Secure AI-Built Software at Machine Speed

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

A Look Inside Lasso's AI Security Platform

Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One.

How to Make Social Engineering Unprofitable

The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.