Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patched three critical VMware vulnerabilities including two CVSS 9.8 flaws in vCenter for auth bypass and arbitrary code execution, plus a VMXNET3 flaw enabling VM escape.
Intelligence analysis by Llama
Broadcom's July 2026 security update addresses five VMware vulnerabilities, three rated critical. The worst allow unauthenticated remote code execution against vCenter and a virtual machine escape from a guest to the ESXi host. No in-the-wild exploitation has been observed.
Imagine a big apartment building where one security guard's desk and the building's computers got broken into. Bad guys could sneak past the guard, then use that to break into any apartment, or even climb out of their own apartment into the building's main computer. The landlord is now fixing the locks, and so far no one has been robbed.
Analysis
A Two-Strike Knockout on vCenter
The headline of Broadcom's July patch cycle is the pair of CVSS 9.8 vulnerabilities, CVE-2026-59309 and CVE-2026-59310, that both sit inside vCenter. The first is a clean authentication bypass, the kind of bug that requires no credentials and no user interaction, only network reachability to the management plane. The second is a directory-traversal flaw that, with the same network access, can be chained into arbitrary code execution. The fact that Broadcom rates both at 9.8 and groups them in the same advisory strongly suggests an attacker could combine them, slipping past authentication and then using the path-traversal primitive to drop a payload. vCenter is the control plane for nearly every VMware deployment, which is why the disclosure reads more like a data-center emergency than a routine bug fix. Patches land in VMware Cloud Foundation and vSphere Foundation 9.1.x.x, 9.0.x.x, and vCenter 8.0 U3k, with an async patch to 5.x Cloud Foundation customers.
A Virtual Machine Escape via VMXNET3
The third critical-severity issue, CVE-2026-47876, is structurally different and arguably more dangerous in the long run. It is an out-of-bounds write in the VMXNET3 paravirtualized network adapter inside VMware ESX. The attack path starts from inside a guest VM, where the attacker already holds local administrative privileges, and lands on code execution on the underlying ESXi host. Broadcom explicitly describes it as a virtual machine escape, the security boundary break that virtualization is supposed to make impossible. Because VMXNET3 is the default high-performance network driver used across most VMware workloads, the population of potentially affected hosts is large. Fixes cover ESXi 9.1.0.0200-25557999, ESXi 9.0.2.0100-25595025, and the ESXi 8.0 U3k bundle. The accompanying CVE-2026-41703 (CVSS 7.6) hits the same component family and can yield information disclosure or denial of service even from a low-privileged guest with only VM deployment rights, which broadens the attacker profile.
Patching at Scale and the Logging Gap
The remaining flaw, CVE-2026-41709, is rated only 2.7 but deserves attention from defenders. It is an insufficient-logging bug in ESX that lets a malicious administrator perform operations that are not recorded in audit trails. In a compliance-heavy enterprise, that is a quiet but real risk because it degrades the forensic record precisely when a privileged insider is the threat. Patches are spread across Cloud Foundation 5.x, vSphere Foundation 9.x, ESXi 8.0 U3i and U3j, plus Workstation 26H1 and Fusion 26H1. Broadcom states it has seen no evidence of in-the-wild exploitation for any of the five issues, which is the one piece of good news, but the absence of observed attacks rarely lasts once a patch advisory ships and proof-of-concept work begins. The practical takeaway for security teams is a fast-track patch window, starting with internet-reachable vCenter instances and then a sweep of ESXi hosts running VMXNET3 on production networks.
Key points
- Two CVSS 9.8 flaws in VMware vCenter enable unauthentication bypass (CVE-2026-59309) and arbitrary code execution via directory traversal (CVE-2026-59310).
- CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the VMXNET3 virtual network adapter that allows a guest VM to escape to the ESXi host.
- CVE-2026-41703 (CVSS 7.6) allows information disclosure or denial of service from a low-privileged guest, while CVE-2026-41709 (CVSS 2.7) lets malicious admins evade ESX audit logging.
- Patches span VMware Cloud Foundation, vSphere Foundation, vCenter 8.0 U3k, ESXi 9.1.0.0200 and 9.0.2.0100 bundles, plus Workstation 26H1 and Fusion 26H1.
- Broadcom reports no evidence of in-the-wild exploitation for any of the five flaws.
Broadcom's rapid coordinated release across vCenter, ESXi, Workstation, Fusion, and Cloud Foundation gives defenders a clean patch matrix in a single cycle. With no observed exploitation, organizations that patch within a normal maintenance window should avoid real-world incidents entirely.
Once the advisory is public, security researchers and attackers typically race to build proof-of-concept exploits for unauthenticated vCenter RCE chains, and VM-escape primitives have a long history of being weaponized quickly. Organizations with sprawling vCenter footprints, especially those with management planes exposed to the internet, face a meaningful window of risk if patching slips beyond a couple of weeks.
