On September 3, 2026, Broadcom released a security advisory—VMSA-2026-0007—highlighting two severe vulnerabilities in VMware’s desktop virtualization tools, namely VMware Workstation and Fusion. These flaws could allow attackers to escape a virtual machine (VM) and execute code on the host system, defying the very security isolation these platforms are meant to guarantee.
The Technical Breakdown
The first flaw, tracked as CVE-2026-59346, exists in the VMXNET3 virtual network adapter and stems from an integer‐overflow vulnerability. Broadcom rates this one highly dangerous—with a CVSSv3 score of 9.3—because it enables a user who already has administrator privileges inside a guest VM, configured with VMXNET3, to run arbitrary code on the underlying host machine. This is a clear example of VM escape, a scenario virtual environments are explicitly designed to prevent.
The second issue, CVE-2026-59347, involves a stack‐based buffer overflow within the Host-Guest File System (HGFS), the component that manages shared folders between host and guest. Although less critical—scoring 8.1 under CVSSv3—this vulnerability still permits someone with admin access inside a guest VM to execute code via the VMX process on the host. While it doesn’t touch the same subsystem as the first flaw, it achieves a similarly dangerous result: a bridge from guest to host.
Affected Products & Fixes
Both vulnerabilities impact VMware Workstation versions 25H2 and 26H1 on all supported host operating systems, plus VMware Fusion versions 25H2 and 26H1 on macOS. Broadcom has issued an update—version 26H1-u1—that patches both flaws across these product lines. There are currently no effective workarounds; the only reliable mitigation is applying the new version.
The bugs were found through private reports: CVE-2026-59346 by researcher h4urek of SecSys Lab and by Y² & Stan S through Trend Micro’s Zero Day Initiative, and CVE-2026-59347 by Yeonghyeon Choi and Tianchu Chen of Tencent’s Xuanwu Lab. Importantly, there’s no evidence that either flaw has been exploited in the wild yet.
What This Means & What to Do
These vulnerabilities strike at the foundation of virtualization security. VMXNET3 and HGFS are commonly used in environments for malware analysis, testing, or development. With local admin access inside a VM—which is often assumed to be less risky—the attacker need only leverage one of these flaws to break into the host machine. That’s a big leap in attack surface.
Administrators should immediately upgrade affected VMware Workstation and Fusion installations to version 26H1-u1. In the meantime, review which VMs use VMXNET3 adapters or shared folder features and limit usage where possible. Monitoring and restricting who has administrative access within VMs becomes even more essential under this threat model.
Analytical Take: These flaws show that even mature virtualization technologies still carry risk vectors that may be overlooked—especially features like shared file systems or virtual networking that blur lines between guest and host. Patching is non-negotiable, but long‐term, virtualization users need to rethink how they handle trust boundaries inside VMs. Least privilege, hardened configurations, and perhaps minimizing shared resources should become part of every virtualization security posture going forward.
