Broadcom published a security advisory detailing five vulnerabilities affecting VMware ESXi, vCenter, Workstation, and Fusion. Three critical vulnerabilities include CVE-2026-47876, an out-of-bounds write in the VMXNET3 virtual network adapter of ESXi allowing VM escape and arbitrary code execution on the host by an attacker with local admin privileges on the VM; CVE-2026-59309, a vCenter authentication bypass enabling unauthorized access; and CVE-2026-59310, a critical vCenter vulnerability permitting remote code execution with network access. Additionally, CVE-2026-41703 is a high-severity issue affecting ESXi, Workstation, and Fusion that can lead to information disclosure or denial of service by an attacker with VM deployment permissions. CVE-2026-41709 is a low-severity ESXi vulnerability allowing certain admin activities without logging. Broadcom is not aware of active exploitation but emphasizes patching due to the critical nature of these flaws.

Successful exploitation of CVE-2026-47876 can lead to VM escape, allowing an attacker with local admin privileges on a VM to execute arbitrary code on the ESXi host, potentially compromising the entire host environment. CVE-2026-59309 allows attackers to bypass vCenter authentication, gaining unauthorized access. CVE-2026-59310 enables remote code execution on vCenter with network access. CVE-2026-41703 can cause information disclosure or denial of service on the host process. CVE-2026-41709 permits unlogged administrative actions, potentially aiding stealthy malicious activities. These vulnerabilities collectively pose a critical risk to the confidentiality, integrity, and availability of VMware environments.

Official patches are available from Broadcom/VMware for all identified vulnerabilities. Organizations should apply these updates promptly to mitigate the critical VM escape, authentication bypass, and remote code execution vulnerabilities. No in-the-wild exploitation has been reported, but timely patching is strongly recommended. Refer to the vendor's security advisory and FAQ for detailed patching instructions and impact information.