Broadcom on Thursday released fixes for two VMware Workstation and Fusion vulnerabilities that let an attacker with administrator rights inside a virtual machine run code on the host. One is rated critical, with a CVSS score of 9.3, and the other high, at 8.1. Both affect Workstation and Fusion versions 25H2 and 26H1 and are fixed in version 26H1u1. Broadcom said there are no workarounds.
Two paths from guest to host
The critical bug, CVE-2026-59346, is an integer overflow in the VMXNET3 virtual network adapter. “A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host,” Broadcom said in its alert, as quoted by The Hacker News. Broadcom credited @h4urek, @cameudis and Stan S with finding it.
The second flaw, CVE-2026-59347, is a stack-based buffer overflow in HGFS, the Host-Guest File System that handles shared folders. An attacker with local admin rights in a VM can use it to execute code as the virtual machine’s VMX process on the host. Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab reported it.
No known exploitation yet
Both issues were reported privately, and Broadcom made no mention of attacks using them, SecurityWeek reported. Exploitation requires admin access inside the guest first, though The Hacker News noted that attackers can get that through a separate compromise such as phishing or weak user configurations.
VMware products are frequent targets. SecurityWeek counted more than two dozen VMware vulnerabilities on CISA’s Known Exploited Vulnerabilities list, and The Hacker News reported that two VMware vCenter flaws, CVE-2026-59309 and CVE-2026-59310, were exploited in August, with an estimated 361 victim IP addresses across 47 countries. Those vCenter bugs were part of Broadcom’s July advisory, VMSA-2026-0006, which also covered ESX, Workstation and Fusion. Broadcom recommends moving Workstation and Fusion installs to 26H1u1 as soon as possible.
WebProNews is an iEntry Publication