Critical VMware Flaws Could Break VM Isolation and Give Attackers Host-Level Code Execution

The most serious issue, tracked as CVE-2026-59346, carries a CVSS score of 9.3 and affects systems using the VMXNET3 virtual network adapter. Successful exploitation could allow an attacker who already has elevated privileges within a guest virtual machine to execute arbitrary code on the host.

A second vulnerability, CVE-2026-59347, has been rated CVSS 8.1 and affects the Host Guest File Sharing (HGFS) functionality.

Executive Summary

1. Threat Level: 🔴 Critical
2. Products: VMware Workstation and VMware Fusion
3. Primary Risk: Virtual machine escape and host code execution
4. Highest CVSS: 9.3
5. Exploitation: No evidence of exploitation in the wild reported
6. Required Attacker Access: Local administrative privileges inside a virtual machine
7. Fixed Versions: VMware Workstation 26H1u1 and VMware Fusion 26H1u1

Key Takeaways

• CVE-2026-59346 is an integer-overflow vulnerability with a CVSS score of 9.3.
• An attacker with local administrative privileges inside a VM could exploit the flaw to execute code on the host.
• The attack requires the affected VM to use the VMXNET3 virtual network adapter.
• CVE-2026-59347, rated 8.1, is a stack-based buffer-overflow vulnerability in HGFS.
• Both vulnerabilities affect VMware Workstation 25H2 and 26H1 and VMware Fusion 25H2 and 26H1.
• Broadcom says there are no workarounds that address the vulnerabilities.
• Users should upgrade to VMware Workstation 26H1u1 or VMware Fusion 26H1u1.

CVE-2026-59346: Critical VM Escape Risk

The most severe vulnerability is an integer-overflow flaw in VMware's virtualization software.

The vulnerability can be exploited by a malicious actor who already possesses local administrative privileges within a virtual machine configured with a VMXNET3 network adapter.

Successful exploitation could allow the attacker to cross the virtual machine boundary and execute arbitrary code on the host operating system.

This is particularly significant in environments where virtual machines are used to isolate potentially untrusted workloads.

A successful VM escape can undermine that isolation and potentially give an attacker access to resources belonging to the host or other virtual machines.

CVSS Score: 9.3 — Critical
CVE-2026-59347: HGFS Buffer Overflow

The second vulnerability, CVE-2026-59347, affects VMware's Host Guest File Sharing (HGFS) functionality.

The flaw is classified as a stack-based buffer overflow and carries a CVSS score of 8.1.

Under the required conditions, an attacker with local administrative privileges inside a virtual machine could exploit the vulnerability to execute code with the privileges of the VMX process running on the host.

Although it has a lower severity rating than CVE-2026-59346, the vulnerability remains significant because exploitation can cross the boundary between the guest virtual machine and the host.

Attack Requirements

These vulnerabilities are not unauthenticated remote vulnerabilities.

An attacker must first obtain local administrative privileges within the affected virtual machine.

This requirement reduces the direct attack surface, but it does not eliminate the risk.

Attackers could potentially obtain administrative access through another compromise, such as:

• Phishing
• Malware infections
• Weak guest OS credentials
• Compromised user accounts
• Poorly secured virtual machines
• Exploitation of another vulnerability

Once administrative control of a guest VM has been achieved, the VMware vulnerabilities could potentially provide a pathway toward compromising the host.

Affected Products

The vulnerabilities affect the following VMware desktop virtualization products:

Organizations should verify the exact version deployed in their environment and apply the appropriate Broadcom security update.

Why VM Escape Vulnerabilities Matter

Virtual machines are frequently used as a security boundary.

Organizations may use them to:

• Isolate development environments
• Run security testing tools
• Host legacy applications
• Separate workloads
• Test potentially malicious software
• Support developer and engineering environments

A vulnerability that allows code execution on the host can weaken this isolation.

Instead of remaining confined to a guest operating system, an attacker could potentially gain access to the underlying host and subsequently target other workloads.

No Known Active Exploitation

Broadcom has not reported evidence that either CVE-2026-59346 or CVE-2026-59347 is being exploited in the wild at the time of disclosure.

However, VMware vulnerabilities have historically attracted significant attention from threat actors.

In July 2026, Broadcom also addressed other serious VMware vulnerabilities, including flaws affecting vCenter and ESX. Some of those vulnerabilities subsequently attracted scanning and suspected exploitation activity.

This makes timely patching particularly important for organizations operating VMware infrastructure.

Mitigation and Recommended Actions

1. Apply the Security Updates

Organizations running affected versions should upgrade to:

1. VMware Workstation 26H1u1
2. VMware Fusion 26H1u1

Broadcom states that there are no alternative workarounds that fully address these vulnerabilities.

2. Review VM Administrative Access

Because exploitation requires administrative privileges inside a VM, organizations should review who has administrative access to guest operating systems.

Remove unnecessary local administrator privileges wherever possible.

3. Monitor Guest-to-Host Activity

Security teams should monitor for unusual activity originating from virtual machines, particularly:

• Unexpected process creation
• Suspicious network connections
• Abnormal VM configuration changes
• Unexpected access to shared folders
• Unusual host interaction
• Suspicious administrative activity

4. Review VMXNET3 Usage

Identify virtual machines using the VMXNET3 network adapter and prioritize those systems for remediation because the adapter is a requirement for exploitation of CVE-2026-59346.

5. Investigate Compromised VMs

If a virtual machine has already shown signs of compromise, do not assume that the attacker has remained inside the guest operating system.

Security teams should also investigate the underlying host for signs of unauthorized execution or configuration changes.

SOC Detection Considerations

SOC teams can enhance monitoring around VMware environments by correlating:

Guest OS activity → VM administrative activity → VMware process activity → Host activity

Particular attention should be paid to unexpected processes originating from virtual machine workloads and unusual interactions between guest systems and host services.

Organizations using EDR on virtualization hosts should ensure that telemetry from the host is included in security monitoring and threat-hunting activities.

Bottom Line

The newly patched VMware vulnerabilities demonstrate the importance of maintaining strong isolation between virtual machines and their underlying hosts.

While exploitation of CVE-2026-59346 and CVE-2026-59347 requires an attacker to already possess administrative privileges inside a guest VM, successful exploitation could allow that attacker to move beyond the virtual machine boundary and execute code on the host.

With CVE-2026-59346 carrying a CVSS score of 9.3, organizations using affected VMware Workstation or Fusion versions should prioritize the available updates rather than relying on the current absence of known exploitation.