Broadcom pushed emergency fixes on July 29, 2026 for three critical flaws in VMware’s virtualization stack, a reminder that the hypervisor layer, not just the applications running on top of it, is now squarely in attackers’ sights.

Advisory VMSA-2026-0006 covers five vulnerabilities in vCenter Server, ESX, Workstation, Fusion, and related Cloud Foundation products, three rated critical. CVE-2026-59309 is an authentication bypass in vCenter’s Directory Service: Broadcom states “a malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system,” no credentials required. CVE-2026-59310 is a directory traversal flaw in the vCenter syslog server letting a network-reachable, unauthenticated attacker execute arbitrary code. Both score CVSS 9.8. CVE-2026-47876 is a VM escape: local admin access inside a VM using the VMXNET3 adapter can trigger an out-of-bounds write and run code on the ESX host, rated 9.3.

Why it matters: vCenter is the management plane for most enterprise VMware environments, the console controlling provisioning, access, and configuration across every hosted VM. An authentication bypass there is administrative control, not a foothold. Broadcom’s advisory says no workarounds exist for any of the five flaws, and it discourages a common mitigation reflex, telling admins not to switch away from the vulnerable VMXNET3 adapter since alternatives have carried their own flaws and may cost performance. Patching, not a workaround, is the only path Broadcom offers.

The pattern tracks a broader shift: infrastructure that manages other infrastructure, a console, a logging pipeline, an out-of-band controller, keeps turning up as the softest target. It echoes the exposure researchers found in tens of thousands of internet-facing baseboard management controllers still leaking credentials through a decade-old IPMI flaw. In both cases, the component meant to give administrators privileged control became the door attackers wanted.

Security teams running affected VMware products should prioritize vCenter and ESX patching given the unauthenticated, no-privilege path on CVE-2026-59309 and CVE-2026-59310, confirm vCenter interfaces sit behind trusted administrative networks only, and inventory which VMs still use VMXNET3 to prioritize host-level patching.

Source: Broadcom