Broadcom Patches Two Critical vCenter Flaws (CVSS 9.8) and an ESXi VM-Escape Bug — No Workarounds Available
CVE-2026-59309 and CVE-2026-59310 let attackers bypass vCenter authentication and gain remote code execution. CVE-2026-47876 lets a malicious VM break out to the ESXi host. Patch now.
Broadcom shipped emergency patches this week for five VMware vulnerabilities, three of them critical, affecting ESXi, vCenter, Workstation, and Fusion. Two of the three hit the maximum-severity range, and none of the five have a workaround — patching is the only fix.
CVE-2026-59309 (CVSS 9.8) is an authentication bypass in the VMware Directory Service. Any attacker with network access to a vulnerable vCenter Server can skip authentication entirely and gain unauthorized access to the system. Broadcom flags it as emergency priority.
CVE-2026-59310 (CVSS 9.8) is a directory-traversal flaw in vCenter’s Syslog Server. An attacker with network access can traverse the filesystem and execute arbitrary code on the affected server — full remote code execution, no credentials required.
CVE-2026-47876 (CVSS 9.3) is different in kind: an out-of-bounds write in the VMXNET3 virtual network adapter. An attacker who already has administrative privileges inside a guest VM using VMXNET3 can escape the VM and execute code directly on the underlying ESXi host — a classic VM-escape scenario that breaks the isolation hypervisors exist to guarantee.
Broadcom says it has no evidence of active exploitation for any of the three, but given the severity and the total absence of mitigations, treat that as a narrow window, not a reason to wait.
Affected and fixed versions:
- VMware Cloud Foundation and vSphere Foundation: patched in 9.1.0.0300 and 9.0.2.0100
- VMware vCenter Server 8.0: patched in update 8.0 U3k
- CVE-2026-47876 (ESXi VMXNET3): remediated under advisory VMSA-2026-0006
What to do now: If you run vCenter Server 8.0 prior to U3k, or Cloud Foundation/vSphere Foundation below the patched builds, apply the update immediately — CVE-2026-59309 and CVE-2026-59310 require no authentication and no user interaction. If you run VMs with VMXNET3 adapters on ESXi, check VMSA-2026-0006 and patch your hosts before your next maintenance window, not after. There is no interim mitigation for any of the three — restricting network access to vCenter management interfaces buys time, but it isn’t a substitute for the patch.
Sources
Related reading
- Cybersecurity Critical SharePoint RCE (CVE-2026-50522, CVSS 9.8) Under Active Exploitation — Attackers Are Stealing Machine Keys
- Cybersecurity Microsoft's Biggest Patch Tuesday Ever: 198 CVEs, Three Zero-Days, One Actively Exploited Defender Flaw
- Cybersecurity CVE-2026-45585 (YellowKey): Unpatched BitLocker Bypass Gives Physical Attacker Full Drive Access — Mitigate Now