Full research report
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Executive assessment
VMSA-2026-0006 discloses a cluster of vulnerabilities that collectively describe a potential multi-stage intrusion path through VMware enterprise infrastructure: unauthenticated network access to vCenter via CVE-2026-59309 yields management-plane control, a directory traversal flaw in the Syslog server (CVE-2026-59310) then permits arbitrary code execution on the vCenter host, and from a compromised guest VM the VMXNET3 out-of-bounds write (CVE-2026-47876) enables a host hypervisor escape. As of 29 July 2026, Broadcom, SecurityWeek, Security Affairs, and CanSSOC all confirm no exploitation in the wild and no public PoC, consistent with coordinated researcher disclosure from Atredis Partners, STARLabs SG, and CrowdStrike. VMware and predecessor products have an established history of rapid weaponisation following advisory publication—particularly for authentication-bypass and VM-escape primitives—making the CVSS 9.8 vCenter pair the highest-priority patching targets. No workarounds exist for any critical-rated CVE, and Broadcom's emergency-change designation reflects the severity of the combined attack surface.
What happened
On 29 July 2026, Broadcom published VMSA-2026-0006, disclosing five vulnerabilities across VMware vCenter, ESXi, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and Telco Cloud products. Three are rated Critical (CVSS 9.3–9.8). Broadcom classified the update as an emergency change requiring immediate action and confirmed no evidence of in-the-wild exploitation at the time of publication. The vulnerabilities were reported by researchers from Atredis Partners, STARLabs SG, and CrowdStrike, consistent with coordinated disclosure.
Affected scope
VMware vCenter Server 8.0 and 9.x; VMware ESXi via Cloud Foundation and vSphere Foundation 9.0/9.1 and ESX 8.0 U3 series; VMware Workstation and Fusion; VMware Cloud Foundation 5.x; VMware Telco Cloud Platform and Telco Cloud Infrastructure. Broadly affects enterprise and cloud data-centre operators running VMware-based virtualisation stacks.
Technical assessment
CVE-2026-59309 bypasses authentication in the VMware Directory Service, granting unauthenticated network-adjacent actors full management-plane access to vCenter. CVE-2026-59310 exploits directory traversal in the vCenter Syslog server, permitting network-accessible arbitrary code execution on the vCenter host. CVE-2026-47876 is an out-of-bounds write in the VMXNET3 virtual network adapter driver that enables a guest VM administrator to corrupt ESXi host memory and execute code on the hypervisor—a VM escape. The two vCenter flaws could chain to produce unauthenticated full infrastructure compromise from the network without physical access.
Recommended defensive actions
- Apply patches per VMSA-2026-0006 immediately: vCenter 8.0 U3k; vCenter/vSphere Foundation 9.1.0.0300 and 9.0.2.0100; ESXi builds 25557999, 25595025, 25595708; Workstation/Fusion 26H1; Cloud Foundation 5.2.3—Broadcom classifies these as emergency changes with no available workarounds
- Restrict network access to vCenter management interfaces to trusted administrative networks or VPNs only, reducing exposure of CVE-2026-59309 and CVE-2026-59310 to pre-authenticated actors
- Audit guest VM accounts holding local administrative privileges on VMs configured with the VMXNET3 adapter; remove unnecessary privileged accounts to limit the pre-condition for CVE-2026-47876
- Monitor vCenter authentication logs and ESXi host logs for anomalous unauthenticated access events, unexpected privilege escalation, or unusual hypervisor-level process activity
Uncertainties and evidence gaps
- No public proof-of-concept has been published as of 29 July 2026; timing of weaponisation is unknown, though VMware critical vulnerabilities have historically attracted rapid exploitation following advisory publication
- Fixed versions for VMware Telco Cloud Platform and Telco Cloud Infrastructure were not enumerated in publicly available sources; operators of those products should consult Broadcom directly
- The precise audit-bypass scope of CVE-2026-41709 (insufficient logging) was not described in available sources, leaving uncertainty about which administrative operations can be concealed from audit logs
- The supplied reporting identifies CVE-2026-41703, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; Broadcom stated no evidence of in-the-wild exploitation as of the advisory date, 29 July 2026.
The investigation began with a single press report of five VMware vulnerabilities published on 29 July 2026. Primary sourcing was obtained directly from Broadcom's official advisory VMSA-2026-0006 and corroborated across SecurityWeek, Security Affairs, VMware's own GitHub compliance repository, and a CanSSOC institutional advisory. No public proof-of-concept code or evidence of active exploitation was identified across all sources consulted, consistent with Broadcom's coordinated-disclosure statement.
- What does the original article state, and does it reference a primary vendor source?Fetched The Hacker News articlethehackernews.com ↗
Confirmed five CVEs with CVSS scores, affected products, fixed versions, and a direct link to the Broadcom advisory; no exploitation in the wild stated
why Established the event baseline and identified the authoritative vendor advisory URL for primary sourcing
- What does Broadcom's official advisory state about scope, researcher credits, and exploitation status?Fetched Broadcom VMSA-2026-0006 advisorysupport.broadcom.com ↗
Confirmed all five CVEs, CVSS scores, eight affected product lines including Telco Cloud, researcher credits from Atredis Partners, STARLabs SG, Maxim Suhanov, and CrowdStrike; no exploitation in the wild; no workarounds; emergency change classification
why Primary vendor source; coordinated researcher credits confirm prior non-public disclosure; no-exploitation statement is authoritative unless contradicted by independent evidence
- Do independent security outlets confirm the same technical facts?Searched for secondary coverage and fetched SecurityWeek articlesecurityweek.com ↗
SecurityWeek independently confirmed the VM escape classification, no active exploitation, and identical affected products and patch versions
why Independent corroboration from a specialist outlet with no contradictions to Broadcom's account
- Is any public proof-of-concept or exploit code available for the highest-severity CVEs?Searched for PoC exploit code for CVE-2026-59309 and CVE-2026-47876
No public PoC identified across any source consulted; all coverage confirmed no exploit code at time of publication
why Absence of PoC on advisory day is consistent with coordinated disclosure; does not preclude future weaponisation given VMware's exploitation history
- Does VMware's own published guidance confirm the advisory?Fetched VMware vcf-security-and-compliance-guidelines GitHub repository entry for VMSA-2026-0006github.com ↗
VMware-controlled repository confirmed advisory scope, all five CVEs, and mandatory patch-only remediation with no workarounds
why Additional primary-source confirmation from VMware's own infrastructure; fully consistent with the Broadcom advisory
- Has any independent CERT or institutional authority issued a corroborating advisory?Fetched CanSSOC advisory from the University of Torontosecurity.utoronto.ca ↗
CanSSOC rated the threat HIGH and independently confirmed CVE IDs, CVSS scores, affected products, and an immediate patch recommendation
why Institutional CERT corroboration from a separate domain completes the requirement for at least two independent verified source domains, supporting high confidence
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1656 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok667 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Vendor & gov advisories3
Primary vendor advisory covering all five CVEs, fixed versions, CVSS scores, and researcher credits
VMware-controlled repository confirming advisory scope and mandatory patching guidance
Independent institutional CERT advisory rating threat HIGH and corroborating affected scope
Analysis & research2
Independent specialist coverage confirming VM escape classification and absence of active exploitation
Independent corroboration of CVE details and patch status from a specialist security outlet