[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPUVMs3-V1ci9bCmz5lnAFNWX4Gi92NcXX1XRch2TQdY":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e9cd0a3a-996f-4611-a11f-86886d274171","VMware Workstation and Fusion Updates Patch Critical Vulnerability","vmware-workstation-and-fusion-updates-patch-critical-vulnerability-d724b0","The flaws could allow attackers with administrative access to a virtual machine to execute code on the host system. The post VMware Workstation and Fusion Updates Patch Critical Vulnerability appeared first on SecurityWeek.","Broadcom has released patches for two critical vulnerabilities in VMware Workstation and Fusion. CVE-2026-59346, an integer overflow, and CVE-2026-59347, a stack-based buffer overflow, could allow attackers with local administrative privileges within a virtual machine to execute code on the host system. While no exploitation in the wild has been reported, VMware products are frequently targeted.","VMware Workstation and Fusion patched critical vulnerabilities allowing host code execution.","https:\u002F\u002Fwww.securityweek.com\u002Fvmware-workstation-and-fusion-updates-patch-critical-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-09-04T11:42:55+00:00","2026-09-04T12:00:08.533657+00:00",8,[17,20,22],{"name":18,"type":19},"VMware Workstation","product",{"name":21,"type":19},"VMware Fusion",{"name":23,"type":24},"Broadcom","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48],{"type":45,"value":46,"context":47},"cve","CVE-2026-59346","Integer overflow vulnerability in VMware Workstation and Fusion.",{"type":45,"value":49,"context":50},"CVE-2026-59347","Stack-based buffer overflow vulnerability in VMware Workstation and Fusion.",[23,18,21],{"controls":53,"vendors":140},[54,83,111],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,95,103],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":84,"product_name":92,"url":93,"description":94},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":155},"critical-vmware-hypervisor-escapes-demand-immediate-patching","Critical VMware Hypervisor Escapes Demand Immediate Patching","Broadcom has disclosed two critical vulnerabilities in VMware Workstation and Fusion — an integer overflow (CVE-2026-59346) and a stack-based buffer overflow (CVE-2026-59347) — both of which enable VM-to-host escape attacks when an attacker holds local admin privileges inside a guest machine. Hypervisor escape vulnerabilities are among the most severe class of flaws in virtualized environments because they break the fundamental security boundary between guest and host systems, potentially exposing the entire physical infrastructure. VMware products are historically high-value targets for threat actors, meaning unpatched systems carry elevated real-world risk even before confirmed exploitation is observed. Organizations relying on virtualization for workload isolation must treat these patches as emergency priority, as the security guarantee of VM containment is nullified until remediation is applied.",[146,147,148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management (Least Privilege)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-125: Guide to Security for Full Virtualization Technologies","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]