Critical VMware Flaws Enable Host Code Execution
Broadcom patches two severe vulnerabilities in VMware Workstation and Fusion
1Critical Vulnerabilities Discovered
Broadcom has identified two severe vulnerabilities in VMware Workstation and Fusion, allowing attackers to execute code on the host system. The first, CVE-2026-59346 (CVSS 9.3), is an integer-overflow flaw in the VMXNET3 virtual network adapter. The second, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in the HGFS component. Both require local admin privileges but can lead to host compromise. Researchers from Tencent Xuanwu Lab and TrendAI Zero Day Initiative reported these issues.
2Exploitation Requirements
Attackers need local administrative privileges within a virtual machine to exploit these flaws. While this limits immediate risk, such privileges can be obtained through phishing or weak configurations. The vulnerabilities affect VMware Workstation and Fusion versions 25H2 and 26H1. Broadcom emphasizes that no workarounds exist, urging users to update to version 26H1u1 immediately. The patches address both vulnerabilities, preventing potential VM-escape scenarios.
3VMXNET3 Vulnerability Details
CVE-2026-59346 targets the VMXNET3 virtual network adapter, a VMware-designed NIC for VMs. An attacker with local admin rights can exploit this integer-overflow flaw to execute arbitrary code on the host. This critical vulnerability was reported by researchers h4urek, cameudis, and Stan S. Broadcom's advisory warns that exploitation could allow full host control, making it a high-priority fix. The flaw specifically impacts VMs using the VMXNET3 adapter, a common configuration in enterprise environments.
4HGFS Vulnerability Breakdown
CVE-2026-59347 is a stack-based buffer overflow in VMware's Host-Guest File System (HGFS), which enables file sharing between host and guest systems. Attackers with VM admin privileges can exploit this to run code as the host's VMX process. Tencent Xuanwu Lab researchers Yeonghyeon Choi and Tianchu Chen discovered this flaw. While rated high (CVSS 8.1), it requires more specific conditions than the VMXNET3 vulnerability. Both flaws highlight risks in VMware's virtualization components.
5Affected Platforms
The vulnerabilities impact VMware Workstation (Windows/Linux) and Fusion (macOS), specifically versions 25H2 and 26H1. Broadcom confirmed patches in version 26H1u1, released on June 15, 2026. No evidence suggests active exploitation, but VMware products are frequent targets. Last month, attackers exploited two vCenter flaws (CVE-2026-59309/59310), breaching 361 IPs across 47 countries. Germany (55), the U.S. (41), and Turkey (38) saw the most infections, indicating global risk.
6Historical Context
VMware vulnerabilities often attract rapid exploitation. The recent vCenter flaws were weaponized within five days of disclosure, primarily by a China-linked APT group. This pattern underscores the urgency of patching VMware products. The current flaws, while not yet exploited, follow similar VM-escape trajectories. Broadcom's acquisition of VMware has intensified focus on its security posture, with these patches being part of ongoing efforts to harden virtualization platforms against advanced threats.
7Mitigation Strategies
Users must update to VMware Workstation/Fusion 26H1u1 immediately, as no workarounds exist. Organizations should audit VM permissions, limiting admin access to trusted users. Monitoring for unusual VM activity can detect early exploitation attempts. Broadcom recommends disabling unnecessary VM components like HGFS if unused. These measures complement patching, reducing attack surfaces. The company also advises reviewing phishing defenses, as credential theft often precedes privilege escalation required for these exploits.
8Broader Implications
These vulnerabilities highlight persistent risks in virtualization security, where VM-escape flaws can bypass isolation guarantees. The criticality of CVE-2026-59346 (CVSS 9.3) reflects its potential for host takeover, a worst-case scenario. As hybrid work expands reliance on virtualization, such flaws threaten enterprise security postures. Proactive patching and privilege management are essential, especially given VMware's widespread use in cloud and data center infrastructures globally.
Original article: The Hacker News — Critical VMware Flaws Enable Host Code Execution