Broadcom has announced critical updates for VMware Workstation and Fusion to address two high-severity vulnerabilities that could allow host system takeover. Users are urged to update immediately.

  • Two critical/high-severity flaws identified in VMware Workstation and Fusion.
  • CVE-2026-59346 holds a massive CVSS score of 9.3.
  • Attackers can potentially escape the VM to execute code on the host system.
  • Immediate update to version 26H1u1 is required.

In a significant security advisory, Broadcom announced on Thursday that it has released patches for two critical and high-severity vulnerabilities affecting VMware Workstation and VMware Fusion. These flaws pose a significant risk to users by potentially allowing attackers to breach the isolation between a virtual machine and the host operating system.

Technical Breakdown of the Flaws

The most severe vulnerability, tracked as CVE-2026-59346, carries a CVSS score of 9.3. This is an integer overflow bug that enables arbitrary code execution. According to Broadcom, a malicious actor with local administrative privileges within a virtual machine utilizing a VMXNET3 virtual network adapter could exploit this to execute code directly on the host machine.

Read Also:Plug and Pwn: New Attack Exploits Windows Plug and Play for SYSTEM Access

The second vulnerability, CVE-2026-59347, is a stack-based buffer overflow with a CVSS score of 8.1. This flaw allows an attacker with local administrative privileges on a VM to execute code as the VMX process running on the host, effectively bypassing the virtualization sandbox.

Why This Matters

BozokMedia analysis shows that 'VM Escape' vulnerabilities are among the most dangerous in the cybersecurity landscape. When the boundary between a guest OS and a host OS is breached, the entire security architecture of the workstation or server is compromised, leading to potential data theft and total system takeover.

The ability to execute code on a host from a guest VM represents the ultimate failure of virtualization security.

Historical Context

VMware products are high-value targets for threat actors. The Cybersecurity and Infrastructure Security Agency (CISA) currently maintains more than two dozen VMware-related vulnerabilities on its Known Exploited Vulnerabilities (KEV) list, highlighting the persistent threat profile of these widely used virtualization tools.

CVE IDSeverity (CVSS)Vulnerability Type
CVE-2026-593469.3 (Critical)Integer Overflow
CVE-2026-593478.1 (High)Buffer Overflow
Did You Know?: Virtualization is used by almost every major cloud provider; a flaw in hypervisor technology can theoretically impact massive data centers.

Frequently Asked Questions

1. Which versions are affected?
VMware Workstation and Fusion versions 25H2 and 26H1 are affected. You should upgrade to version 26H1u1.

2. Is there a workaround?
No, there are currently no workarounds available for these vulnerabilities other than applying the official patch.