VMware patches critical flaws: VM escape and risk of total control of the virtual infrastructure

Introduction

Broadcom recently released security updates for several VMware products, fixing three critical vulnerabilities and two of lower severity. The patches affect ESXi, vCenter, Workstation, and Fusion and arrive at a time when threat actors’ attention to virtualization platforms remains high. The most severe flaw allows a user with administrative privileges on a virtual machine to escape the sandboxed environment and achieve code execution on the hypervisor, endangering the entire infrastructure.

Technical Analysis

The security advisory highlights five CVEs, three of which are classified as critical.

CVE	Severity	Product/Component	Description
CVE-2026-47876	Critical	ESXi (VMXNET3)	Out-of-bounds write in the virtual network adapter. Exploitable by a local administrator in a guest VM to execute arbitrary code on the host (VM escape).
CVE-2026-59309	Critical	vCenter	Authentication bypass enabling unauthorized access to the management system.
CVE-2026-59310	Critical	vCenter	Remote code execution (RCE) over the network, without requiring valid credentials.
CVE-2026-41703	High	ESXi, Workstation, Fusion	Abuse of VM deployment permissions to cause information disclosure or denial of service on the host process.
CVE-2026-41709	Low	ESXi	An administrator can perform operations without them being logged, reducing traceability.

The most alarming issue lies in the out-of-bounds write in VMXNET3 (CVE-2026-47876): an attacker who has already compromised a single virtual machine can escape the guest context and gain control of the ESXi host. The vCenter vulnerabilities (CVE-2026-59309 and CVE-2026-59310) can instead be exploited remotely to take over the management console, often the nerve center of entire data centers.

Impact

The worst-case scenario sees an attacker exploiting the VM escape to move from a single VM to controlling the hypervisor. This would allow them to access all other virtual machines residing on the same host, intercept their data, modify their behavior, or spread ransomware. Compromise of vCenter further amplifies the risks: a malicious insider or an external attacker could manage the entire virtual infrastructure, move laterally toward other corporate systems, and exfiltrate sensitive information. The high-severity vulnerability (CVE-2026-41703) should not be overlooked either, as it could cause service disruptions or exposure of confidential data, especially in multi-tenant or cloud environments.

At the time of publishing the advisory, Broadcom has not detected active exploitation in real-world environments (no “in-the-wild”). However, given the criticality and the history of VMware vulnerabilities being targeted by APT and ransomware groups, the window for applying patches must be as short as possible.

Mitigation

• Apply updates immediately for ESXi, vCenter, Workstation, and Fusion, following the official guidance published by Broadcom.
• Limit administrative access to virtual machines and reduce the attack surface: not all users need high privileges on guests.
• Segment the management network: isolate the management interfaces of ESXi and vCenter from the rest of the corporate traffic, using dedicated VLANs and firewalls.
• Actively monitor logs of VMware platforms to identify anomalous activities, especially regarding administrative accounts.
• While waiting for patching, consider applying compensating controls such as disabling non-essential components (where supported) and hardening access policies.

Broadcom has also published a separate FAQ with details on impact, fixed versions, and upgrade procedures: it is recommended to consult it for proper management of the remediation cycle.

FAQ

1. Which VMware products are affected by these vulnerabilities?
The patches cover ESXi (including the VMXNET3 network component), vCenter Server, VMware Workstation, and Fusion. Other products such as NSX or vRealize are not mentioned in this specific advisory.

2. Are the vulnerabilities already being exploited by attackers?
According to Broadcom’s statement, at the time of release there is no evidence of active in-the-wild exploitation. However, given the severity and ease of potential exploitation (especially for the RCEs on vCenter), it is crucial to update without delay.

3. I cannot apply the patches immediately: what can I do in the short term?
While waiting for patching, it is advisable to restrict administrative access to VMs as much as possible and segment the management network, ensuring that ESXi and vCenter management interfaces are not reachable from the Internet or untrusted networks. Additionally, it is useful to enhance log monitoring and set up alerts for suspicious operations, such as the creation of new accounts or unplanned changes to VM configurations.