VMware vCenter/ESX Multiple Critical Vulnerabilities Advisory (CVE-2026-Series)

Vulnerability Overview VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709). Affected Products VMware ESX VMware vCenter VMware Workstation VMware Fusion VMware Cloud Foundation VMware vSphere Foundation VMware Telco Cloud Platform VMware Telco Cloud Infrastructure Remediation 1. vCenter Authentication Bypass Vulnerability (CVE-2026-59309) Description: VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. Known Attack Vectors: An attacker with network access may exploit this vulnerability to bypass authentication and gain unauthorized access to the system. Remediation: Apply the patches listed in the "Fixed Versions" column of the Response Matrix. Workaround: None. 2. vCenter Directory Traversal Vulnerability (CVE-2026-59310) Description: VMware vCenter contains a directory traversal vulnerability in the Syslog Server. Known Attack Vectors: An attacker with network access may exploit this vulnerability to execute arbitrary code. Remediation: Apply the patches listed in the "Fixed Versions" column of the Response Matrix. Workaround: None. 3. VMXNET3 Out-of-Bounds Write Vulnerability (CVE-2026-47876) Description: VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. Known Attack Vectors: An attacker with local management privileges for a virtual machine may exploit this vulnerability to execute code on the host. Remediation: Apply the patches listed in the "Fixed Versions" column of the Response Matrix. Workaround: None. 4. Out-of-Bounds Read Vulnerability (CVE-2026-41703) Description: VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. Known Attack Vectors: An attacker with VM deployment privileges may trigger an out-of-bounds read, potentially leading to information disclosure or denial of service (DoS). Remediation: Apply the patches listed in the "Fixed Versions" column of the Response Matrix. Workaround: None. 5. Insufficient Logging Vulnerability in ESX (CVE-2026-41709) Description: VMware ESX contains an insufficient logging vulnerability. Known Attack Vectors: An attacker with administrative privileges may exploit this vulnerability to perform certain actions without them being logged. Remediation: Apply the patches listed in the "Fixed Versions" column of the Response Matrix. Workaround: None. Response Matrix References VMware Cloud Foundation 9.1.0.x VMware Cloud Foundation 9.0.x VMware vSphere Foundation 9.1.0.x VMware vSphere Foundation 9.0.x VMware Cloud Foundation 5.2.4 VMware Cloud Foundation 5.2.3 VMware vCenter 9.1.0.0300 VMware vCenter 9.0.2.0100 VMware ESX 9.1.0.0200 VMware ESX 9.0.2.0100 VMware vCenter 8.0 U3k VMware ESX 8.0 U3k VMware ESX 8.0 U3j VMware ESX 8.0 U3i VMware Workstation 26H1 VMware Fusion 26H1 Additional Links Mitre CVE Dictionary Links FIRST CVSSv3 Calculator Change Log 2026-07-29: Initial Security Advisory for VMSA-2026-0006 Contact Information Email: vmware@broadcom.com PGP Key: https://knowledge.broadcom.com/external/article/321551 VMware Security Advisories: https://www.broadcom.com/support/vmware-security-advisories VMware External Vulnerability Response and Remediation Policy: https://www.broadcom.com/support/vmware-services/security-response VMware Lifecycle Support Phases: https://support.broadcom.com/group/eci/productlifecycle VMware Security Blog: https://blogs.vmware.com/security X: https://x.com/VMwareSRC --- Copyright: 2005-2026 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.

Goal Reached Thanks to every supporter — we hit 100%!

VMware vCenter/ESX Multiple Critical Vulnerabilities Advisory (CVE-2026-Series)