Critical VM Escape Vulnerability Patched in VMware ESXi
VMware patches critical VM escape and other vulnerabilities in ESXi, vCenter, Workstation, and Fusion.
Broadcom has released security advisories for multiple vulnerabilities affecting VMware products including ESXi, vCenter, Workstation, and Fusion. Three of these are rated 'critical,' including a VM escape vulnerability (CVE-2026-47876) in the VMXNET3 virtual network adapter that allows code execution on the host. Other critical flaws include a vCenter authentication bypass and a remote code execution vulnerability. While no in-the-wild exploitation is currently known, prompt patching is advised.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Broadcom?
Get an email when a new story names Broadcom, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability (CVE-2026-47876) in the VMXNET3 virtual network adapter allows an attacker to escape a guest virtual machine and execute code directly on the ESXi host, potentially compromising every VM running on that hypervisor. Paired with a vCenter authentication bypass and a remote code execution flaw, this cluster of vulnerabilities represents a severe risk to virtualized infrastructure. The hypervisor layer is foundational — a breach here can cascade across entire data centers or cloud environments. Although no active exploitation has been confirmed, history shows that high-profile VMware vulnerabilities are rapidly weaponized after public disclosure, leaving narrow patching windows.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-47876
- cve — CVE-2026-59309
- cve — CVE-2026-59310
- cve — CVE-2026-41703
- cve — CVE-2026-41709