Broadcom has issued important security updates to address two vulnerabilities in VMware Workstation and Fusion, one of which is particularly severe. The critical flaw, identified as CVE-2026-59346 with a CVSS score of 9.3, can lead to arbitrary code execution when a local attacker has elevated privileges.
Understanding the Critical Vulnerability
The primary issue is an integer-overflow vulnerability that allows a malicious individual with administrative control on a virtual machine using the VMXNET3 network adapter to execute code on the host system. This flaw was discovered by security researchers @h4urek, @cameudis, and Stan S, who have been recognized by Broadcom for their contribution.
In addition to this, another vulnerability, CVE-2026-59347, with a CVSS score of 8.1, was also addressed. This stack-based buffer overflow in HGFS can be exploited similarly by a local admin to execute code as the VMX process on the host. Researchers Yeonghyeon Choi and Tianchu Chen from Tencent Xuanwu Lab were credited for identifying this issue.
Exploitation Prerequisites and Impact
Exploitation of these vulnerabilities requires the attacker to have local administrative privileges, which can sometimes be acquired through phishing attacks or exploiting weak user configurations. The affected versions are VMware Workstation and VMware Fusion 25H2 and 26H1, and the security patches have been applied in VMware Workstation 26H1u1 and VMware Fusion 26H1u1.
While there is currently no evidence of these vulnerabilities being exploited in real-world scenarios, VMware products have historically been attractive targets for cybercriminals. In previous incidents, vulnerabilities in VMware vCenter, such as CVE-2026-59309 and CVE-2026-59310, have been actively exploited, with a suspected Chinese APT actor involved.
Global Implications and Security Recommendations
Recent activity related to VMware exploits has affected numerous IP addresses globally, with significant infections reported in countries like Germany, the United States, Turkey, Iran, and France. This highlights the importance of timely updates and maintaining robust security protocols.
Organizations using affected VMware products are advised to implement the updates promptly to mitigate any potential risks. Staying vigilant against phishing attempts and ensuring secure configurations can further protect systems from unauthorized access.
The swift action by Broadcom to address these vulnerabilities underscores the ongoing need for proactive security measures in safeguarding critical IT infrastructure.
