Broadcom Patches Critical VMware Workstation and Fusion Flaws Allowing Host Code Execution
Broadcom has released security updates for VMware Workstation and VMware Fusion to address two high-severity vulnerabilities, including a critical flaw that could allow attackers to execute arbitrary code on the host system.
The most serious vulnerability, tracked as CVE-2026-59346, carries a CVSS score of 9.3 and affects the VMXNET3 virtual network adapter.
A successful attack could allow a malicious actor with local administrative privileges inside a virtual machine to execute code on the underlying host.
Critical VMware Vulnerability CVE-2026-59346
CVE-2026-59346 is an integer-overflow vulnerability affecting VMware Workstation and Fusion.
According to Broadcom, exploitation requires an attacker to already have local administrative privileges on a virtual machine using the VMXNET3 virtual network adapter.
Once the required privileges are obtained, the vulnerability could potentially be abused to execute arbitrary code on the host system.
Broadcom credited @h4urek, @cameudis, and Stan S for discovering and reporting the vulnerability.
The flaw is particularly concerning because a compromise that initially begins inside a virtual machine could potentially be escalated into a compromise of the host operating system.
Second VMware Flaw Impacts HGFS
Broadcom also addressed a second vulnerability tracked as CVE-2026-59347, which has a CVSS score of 8.1.
The issue is described as a stack-based buffer-overflow vulnerability in HGFS, VMware's Host Guest File Sharing component.
An attacker with local administrative privileges inside a virtual machine could exploit the flaw to execute code as the VMX process running on the host.
Broadcom credited Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab with reporting the vulnerability.
Exploitation Requires Local Administrative Access
Both vulnerabilities require attackers to already possess local administrative privileges within the virtual machine.
This requirement reduces the likelihood of direct remote exploitation in a typical deployment, but it does not eliminate the risk.
Attackers could potentially obtain the necessary privileges through an earlier compromise, such as:
- Phishing attacks
- Malware infections
- Weak local credentials
- Poorly configured virtual machines
- Compromised user accounts
- Other vulnerabilities that provide local administrative access
Once administrative access inside the guest operating system has been obtained, the VMware vulnerabilities could potentially provide a path toward executing code on the host.
VMware Workstation and Fusion Versions Affected
Broadcom said the vulnerabilities affect the following versions:
- VMware Workstation 25H2
- VMware Workstation 26H1
- VMware Fusion 25H2
- VMware Fusion 26H1
The company said there are no workarounds that fully address the vulnerabilities.
The security issues have been fixed in:
- VMware Workstation 26H1u1
- VMware Fusion 26H1u1
Organizations and individual users running affected versions are advised to upgrade to the patched releases.
No Evidence of Active Exploitation
Broadcom said there is currently no evidence that CVE-2026-59346 or CVE-2026-59347 has been exploited in the wild.
However, VMware products have historically attracted significant attention from threat actors, particularly vulnerabilities that can provide access to virtualization infrastructure.
Security teams should therefore prioritize patching systems that host sensitive workloads or are accessible to untrusted users.
VMware vCenter Vulnerabilities Recently Exploited
The disclosure comes shortly after threat actors were observed actively exploiting two other VMware vulnerabilities, CVE-2026-59309 and CVE-2026-59310, affecting VMware vCenter.
The latter vulnerability was suspected of being exploited by a China-nexus advanced persistent threat (APT) actor.
The exploitation activity reportedly began only five calendar days after public disclosure of the vulnerabilities.
Researchers estimated that the activity compromised 361 unique victim IP addresses across 47 countries.
The largest concentrations of affected IP addresses were reported in:
- Germany: 55
- United States: 41
- Turkey: 38
- Iran: 26
- France: 25
The activity highlights the speed at which attackers can weaponize newly disclosed vulnerabilities in virtualization products.
Why These VMware Vulnerabilities Matter
Virtualization platforms provide a security boundary between guest operating systems and their underlying hosts.
A vulnerability that allows code execution on the host can therefore have a significantly greater impact than a conventional guest-system vulnerability.
If an attacker successfully escapes the intended virtual-machine boundary, they could potentially gain access to:
- Host operating system resources
- Other virtual machines
- Sensitive files
- Network interfaces
- Credentials and secrets
- Virtualization management infrastructure
- Corporate workloads hosted on the same system
For organizations running development, testing, cloud, or enterprise workloads through VMware Workstation or Fusion, keeping virtualization software fully patched is therefore an important part of maintaining the host security boundary.
Security Recommendations
Organizations and users running affected VMware products should:
- Upgrade VMware Workstation to 26H1u1 or later.
- Upgrade VMware Fusion to 26H1u1 or later.
- Review virtual machines for signs of unauthorized administrative access.
- Investigate suspicious processes or unexpected privilege escalation inside guest systems.
- Review authentication and endpoint logs for compromised accounts.
- Ensure guest operating systems are also fully patched.
- Restrict unnecessary administrative privileges inside virtual machines.
- Monitor virtualization hosts for unusual process execution or unexpected network activity.
Because Broadcom has not provided a workaround for the two vulnerabilities, upgrading to the fixed versions is the primary recommended mitigation.
Conclusion
The two newly patched VMware vulnerabilities demonstrate the security risks associated with virtualization software that bridges guest operating systems and host environments.
While exploitation of CVE-2026-59346 and CVE-2026-59347 currently requires local administrative privileges inside a virtual machine and there is no confirmed evidence of in-the-wild exploitation, successful exploitation could result in code execution with access to the host environment.
Given the recent exploitation of other VMware vulnerabilities, organizations should treat these updates as a high-priority patching task, particularly on systems hosting sensitive workloads.
