VMware fixes three critical flaws allowing auth bypass, VM escapes
Source Bleeping Computer
Mentioned vulnerabilities
Fixed in 9.1.0.0301 : patch affected systems as a priority.
Data as of 2 Aug 2026, 00:01 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 9.1.0.0301, 9.1.0.0201, 9.0.2.0101
What to do
AI-suggested
Official security updates are available and should be applied immediately as emergency changes. Fixed versions include vCenter 9.1.0.0300, 9.0.2.0100, 8.0 Update 3k; ESXi 9.1.0.0200, 9.0.2.0100, 8.0 Update 3k; and Workstation/Fusion 26H1. There are no workarounds. Administrators should plan for temporary service interruptions during patching, including vCenter management interface downtime and ESX host restarts. Use vMotion to migrate virtual machines during ESX updates to minimize disruption. ESX Live Patch can reduce downtime but is not applicable to vCenter updates. Avoid switching virtual network adapters away from VMXNET3 due to performance and security considerations. Check Broadcom's advisory for detailed patching instructions and compatibility notes.
Description
Broadcom has released security updates to fix five vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, including three critical flaws that allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. [...]