VMware fixes three critical flaws allowing auth bypass, VM escapes

Broadcom disclosed three critical vulnerabilities in VMware vCenter, ESXi, Workstation, and Fusion that allow unauthenticated attackers to bypass authentication, execute arbitrary code, and escape virtual machine boundaries to compromise the underlying host. With CVSS scores of 9.8 and 9.3, these flaws represent a severe risk to virtualized infrastructure, which often underpins entire enterprise environments. VM escape vulnerabilities are particularly dangerous because they can allow an attacker who has compromised a guest VM to pivot to the hypervisor and potentially every other VM running on the same host. The emergency designation from Broadcom underscores that the window between disclosure and active exploitation is extremely short for high-profile virtualization platforms, making delayed patching unacceptable.