Vulnerabilities · 49 days ago
Broadcom patched two VMware Workstation and Fusion flaws on day one of this development, fixing CVE-2026-59346 and CVE-2026-59347 in 26H1u1 for the 25H2 and 26H1 lines. Both bugs let a local administrator inside a virtual machine push execution onto the host side of VMware’s code.
One issue is an integer overflow in VMXNET3 virtual networking; the other is a stack-based buffer overflow in HGFS, the shared-folder path. In both cases, the guest stops being a hard boundary once an attacker already has admin inside it, so the host process that services the VM can be made to run attacker-controlled code.
The larger VMware lesson is that the estate is being hit from two directions at once: these Workstation and Fusion bugs are unexploited, while separate vCenter flaws, CVE-2026-59309 and CVE-2026-59310, are already under active attack by a China-nexus APT. If your environment spans desktop hypervisors and centralized management, the exposure is now family-level, not product-by-product.
5 sources covering this story
Zero Day Initiative Advisories
VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation Vulnerability Vulnerability Details This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation.
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom patched two VMware Workstation and Fusion flaws that let local VM administrators execute code on the host; no exploitation is known.
VMware Workstation and Fusion Updates Patch Critical Vulnerability
The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system.
Múltiples vulnerabilidades en productos de VMware
h4urek, de secsys lab, Y² y Stan S de TrendAI Zero Day Initiative han informado sobre 2 vulnerab
Risolte vulnerabilità in VMware Workstation e Fusion
Aggiornamenti di sicurezza Broadcom sanano due vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", presenti in VMware Workstation e Fusion.
Part of the PlainSec briefing for 2026-09-07