Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Summary: Broadcom released updates for VMware ESX, vCenter, Workstation, and Fusion covering multiple flaws, three rated critical, including an authentication bypass in vCenter (CVE-2026-59309, CVSS 9.8) and a directory-traversal flaw in vCenter (CVE-2026-59310, CVSS 9.8) that allows arbitrary code execution. Broadcom said it found no evidence of in-the-wild exploitation, but there are no workarounds and it classified the updates as an emergency change requiring immediate action; Defused Cyber reported on August 11, 2026 a spike in scanning against vCenter, with honeypots logging version probes via POST /sdk/ and walks of the /websso SAML SSO flow.
What you should know: A CVSS 9.8 authentication bypass in vCenter needs no credentials, and Defused Cyber's honeypots are already recording the fingerprinting that precedes exploitation - while Broadcom offers no workaround, only the patch.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-47876CVE-2026-59309CVE-2026-59310
- Related