Broadcom has issued security updates addressing five vulnerabilities in VMware products that could allow authentication bypass, code execution, and virtual machine escapes in corporate virtualized environments.
The most critical flaw, tracked as CVE-2026-59309 with a CVSS score of 9.8, affects the VMware Directory Service component of vCenter. An attacker with network access to the server can bypass authentication mechanisms and gain access without valid credentials.
Because vCenter manages hosts, virtual machines, networks, and storage, unauthorized access carries significant risk, potentially enabling infrastructure changes, service disruption, and compromise of business workloads.
Another high-severity issue, CVE-2026-47876, resides in the VMXNET3 virtual network adapter of ESX. An attacker with administrative privileges inside a virtual machine can exploit an out-of-bounds write condition to execute arbitrary code directly on the hypervisor host.
The update package also resolves an unauthorized memory read vulnerability affecting ESX, Workstation, and Fusion, as well as a logging deficiency that could allow certain administrative actions to go undetected.
No temporary mitigations are available. Administrators are advised to update vCenter to versions 9.1.0.0300, 9.0.2.0100, or 8.0 U3k, apply corresponding patches to ESX hosts and Cloud Foundation, and upgrade Workstation and Fusion to version 26H1.
