VMware ESX, vCenter, Workstation and Fusion: updates are closing critical gaps

Broadcom has released critical security updates for several of its VMware products following the discovery of multiple vulnerabilities that could allow attackers to bypass authentication and gain unauthorized access to systems. The flaws affect VMware ESX, vCenter, Workstation, and Fusion, according to a security advisory issued by the company. These vulnerabilities pose serious risks, with some rated as critical on the Common Vulnerability Scoring System (CVSS). The most severe issue involves a flaw in the VMware Directory Service, which allows unauthenticated users to access systems without proper credentials. This vulnerability, identified as CVE-2026-59309, carries a CVSS score of 9.8 and is classified as high risk. Attackers exploiting this weakness can bypass authentication mechanisms entirely, potentially leading to complete system compromise. Another critical vulnerability, CVE-2026-59310, relates to a path traversal flaw in the Syslog Server component. This allows malicious actors to inject and execute arbitrary code remotely, further increasing the potential impact of an exploit. Both issues highlight the need for immediate patching to prevent unauthorized access and remote code execution. A third critical vulnerability affects the virtual network adapter known as VMXNET3 in VMware ESX. This flaw enables local administrators to break out of a virtual machine and gain access to the host system by performing writes outside of allocated memory boundaries. Identified as CVE-2026-47876, this vulnerability has a CVSS score of 9.3 and poses a significant threat to system integrity. Additional high-risk vulnerabilities have been identified, including one that allows attackers with the ability to roll virtual machines to read outside of allocated memory spaces in VMware ESX, Workstation, and Fusion. This could lead to information leakage or denial-of-service attacks, as noted in CVE-2026-41703, which has a CVSS score of 7.6. While many of these vulnerabilities are rated as critical or high risk, there is also a lower-risk issue affecting VMware ESX. This flaw, CVE-2026-41709, allows certain operations to be performed without being logged, giving attackers the opportunity to act covertly within the system. However, due to its low CVSS score of 2.7, this vulnerability presents less of an immediate threat compared to others. Broadcom has provided updated software packages to address these vulnerabilities across affected products. Updated versions include VMware Cloud Foundation and vSphere Foundation 9.1.0.0300 and 9.0.2.0100, along with specific ESXi versions such as ESXi-9.1.0.0200-25557999 and ESXi-9.0.2.0100-25595025. For VMware vCenter and Cloud Foundation 8.0 U3k, additional patches are available under the designation vCenter ESXi80U3k-25595708. For the Telco Cloud Platform and Telco Cloud Infrastructure, Broadcom has published knowledge base articles detailing the necessary steps for correcting these errors. Additionally, updated versions of VMware ESX, ESXi80U3i-25205845, VMware Fusion, Workstation 26H1, and Cloud Foundation 5.2.3 are available to mitigate the risks associated with unauthorized access and denial-of-service attacks. Organizations using these products are strongly advised to apply the latest patches promptly to ensure their systems remain secure against potential exploitation. Failure to update could expose sensitive infrastructure to cyber threats, making timely action essential to maintain operational continuity and data protection.