Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Summary: Broadcom patched two VMware Workstation and Fusion flaws, including CVE-2026-59346 (CVSS 9.3), an integer-overflow bug that lets a local attacker with administrative privileges on a VM using a VMXNET3 virtual network adapter execute code on the host. The second, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in HGFS that allows code execution as the VMX process on the host; both affect versions 25H2 and 26H1 and are fixed in 26H1u1, with no workarounds available.
Bottom line: Exploitation requires local admin rights on the guest, which the source notes can be obtained through phishing or weak configurations - and VMware flaws have drawn active exploitation before, with CVE-2026-59309 and CVE-2026-59310 in vCenter breached across 361 victim IPs in 47 countries within days of disclosure.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-59309CVE-2026-59310CVE-2026-59346CVE-2026-59347
- Related