Broadcom has released a critical security advisory addressing multiple high-impact vulnerabilities in VMware products, including vCenter Server, ESXi, Workstation, and Fusion, that could allow attackers to bypass authentication and execute arbitrary code.
Tracked under VMSA-2026-0006, the flaws carry CVSS scores ranging from 2.7 to 9.8, with the most severe issues affecting VMware vCenter.
The vulnerabilities affect widely deployed enterprise platforms, including VMware Cloud Foundation, vSphere Foundation, and Telco Cloud environments.
Critical VMware vCenter Flaws
The most severe flaw, CVE-2026-59309 (CVSS 9.8), is an authentication bypass vulnerability in the VMware Directory Service.
A remote attacker with network access to vCenter can exploit this issue to gain unauthorized access without valid credentials. This significantly lowers the barrier to compromise, especially in environments where vCenter is exposed.
CVE-2026-59310, also scoring 9.8, is a directory traversal vulnerability in vCenter’s Syslog server that allows a network-adjacent attacker to execute arbitrary code on the host.
Both critical flaws affect vCenter across versions 9.1.x, 9.0.x, 8.0, and 5.x deployments within Cloud Foundation, vSphere Foundation, and Telco Cloud products, and were likewise reported by the Atredis Partners duo.
The advisory also patches three lower-severity issues. CVE-2026-47876 is a critical (CVSSv3 9.3) out-of-bounds write in the VMXNET3 virtual network adapter, exploitable by an attacker with local administrative privileges on a VM to execute code on the host.
CVE-2026-41703 is an important-severity (7.6) out-of-bounds read affecting ESX, Workstation, and Fusion that can cause information disclosure or denial-of-service on ESX hosts, reported by Maxim Suhanov.
CVE-2026-41709 is a low-severity (2.7) insufficient-logging flaw in ESX that allows a malicious administrator to perform unlogged operations, credited to Ian Barton of CrowdStrike.
| Product/Version | CVE(s) | CVSSv3 | Fixed Version |
|---|---|---|---|
| vCenter 9.1.x | 59309, 59310 | 9.8 | 9.1.0.0300 |
| vCenter 9.0.x | 59309, 59310 | 9.8 | 9.0.2.0100 |
| vCenter 8.0 | 59309, 59310 | 9.8 | 8.0 U3k |
| vCenter (Cloud Foundation 5.x) | 59309, 59310 | 9.8 | Async patch to 8.0 U3k |
| ESX 9.1.x | 47876 | 9.3 | ESXi-9.1.0.0200-25557999 |
| ESX 8.0 | 47876 | 9.3 | ESXi80U3k-25595708 |
| Workstation/Fusion 25H2 | 41703 | 2.7-7.6 | 26H1 |
Broadcom notes that patches are cumulative, so vCenter 9.1.0.0300 includes the CVE-2026-59309 fix originally shipped in 9.1.0.0200. Administrators running Telco Cloud Platform or Telco Cloud Infrastructure should refer to KB449886 for remediation guidance.
Given the network-exploitable, no-authentication-required nature of CVE-2026-59309 and CVE-2026-59310, organizations running internet-reachable or lateral-movement-exposed vCenter instances should prioritize immediate patching, since no compensating workaround has been published.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
