[EN] Critical VMware Security Vulnerabilities: Emergency Update Guide for VMSA-2026-0006

Broadcom published the VMSA-2026-0006 security advisory on July 29, 2026, covering several critical vulnerabilities affecting VMware infrastructure.

The advisory addresses five security vulnerabilities discovered in VMware vCenter Server, VMware ESX/ESXi, VMware Workstation, and VMware Fusion.

The CVSS scores of the disclosed vulnerabilities range from 2.7 to 9.8. Two vulnerabilities affecting vCenter Server are especially critical because they may allow an unauthenticated remote attacker to bypass authentication and execute arbitrary code.

Broadcom also states that there are no available workarounds for these vulnerabilities. Organizations must install the relevant VMware updates to secure their environments.

Products Affected by VMSA-2026-0006

The primary VMware products affected by the advisory include:

VMware vCenter Server
VMware ESX/ESXi
VMware Workstation
VMware Fusion

Platforms that include these components may also be indirectly affected, including:

VMware Cloud Foundation
VMware vSphere Foundation
VMware Telco Cloud Platform
VMware Telco Cloud Infrastructure

Broadcom recommends treating any system running a version older than the fixed releases listed in the advisory as vulnerable.

When there is uncertainty about a product version or build number, administrators should assume that the system is affected and begin the update process.

Security Vulnerabilities Included in the Advisory

CVE-2026-59309: vCenter Server Authentication Bypass

CVSS score: 9.8 – Critical

This vulnerability exists in the VMware Directory Service component of VMware vCenter Server.

An attacker who has network access to the vCenter Server but does not have valid user credentials may exploit the vulnerability to bypass the authentication mechanism and gain unauthorized access to the system.

A compromised vCenter Server may provide an attacker with access to the central management layer of the virtual infrastructure.

For this reason, the risk is not limited to the vCenter appliance itself. All ESX/ESXi hosts, virtual machines, networks, datastores, and administrative operations managed through vCenter could potentially be affected.

There is no workaround for this vulnerability. The vCenter Server must be upgraded to a fixed version.

CVE-2026-59310: vCenter Server Directory Traversal and Remote Code Execution

CVSS score: 9.8 – Critical

The second critical vulnerability affects the Syslog Server component of VMware vCenter Server.

The vulnerability is caused by a directory traversal weakness. An attacker with network access to the vCenter Server may exploit it to access unintended file system paths and execute arbitrary code.

The attacker does not need to authenticate before exploiting the vulnerability.

Therefore, the risk becomes significantly higher when the vCenter management interface is accessible from broad internal networks, user networks, the internet, or other untrusted systems.

Organizations should strictly limit access to the vCenter management network and apply the relevant update without delay.

CVE-2026-47876: VMXNET3 VM Escape Vulnerability

CVSS score: 9.3 – Critical

This vulnerability affects the VMXNET3 virtual network adapter used by virtual machines running on VMware ESX/ESXi.

An attacker who already has local administrative privileges inside a virtual machine configured with a VMXNET3 adapter may exploit an out-of-bounds write vulnerability to execute code on the underlying ESX/ESXi host.

This type of attack is known as a VM Escape.

A VM Escape occurs when an attacker breaks out of the isolated virtual machine environment and reaches the hypervisor or host layer.

The attacker must first obtain administrative privileges within the virtual machine. However, once these privileges are obtained, the attack may no longer remain limited to the compromised guest operating system.

It may potentially affect the ESX/ESXi host and other workloads running on the same infrastructure.

Virtual network adapters other than VMXNET3 are not directly affected by this vulnerability.

However, Broadcom does not recommend replacing VMXNET3 with an older adapter such as E1000 as a permanent solution. The correct remediation is to update the ESX/ESXi hosts.

CVE-2026-41703: Out-of-Bounds Read Vulnerability

CVSS score for ESX/ESXi: 7.6 – Important

This vulnerability affects VMware ESX/ESXi, VMware Workstation, and VMware Fusion.

An attacker with permission to deploy or create virtual machines may trigger an out-of-bounds read condition.

Successful exploitation may result in:

Disclosure of sensitive information
Crashing of the affected host process
Denial-of-service conditions
Reduced availability of the virtualization environment

According to Broadcom, this vulnerability does not allow host-level code execution on ESX/ESXi.

For VMware Workstation and VMware Fusion, the impact is primarily limited to information disclosure.

VMware Workstation 25H2 and VMware Fusion 25H2 are affected. The vulnerability has been resolved in the 26H1 releases.

CVE-2026-41709: Insufficient Logging in ESX/ESXi

CVSS score: 2.7 – Low

This vulnerability affects the logging of certain administrative actions on VMware ESX/ESXi.

A malicious user with administrative privileges on an ESX/ESXi host may perform specific operations without those activities being properly recorded in security or audit logs.

Although the CVSS score is low, the vulnerability may still be important for organizations operating in highly regulated environments such as:

Financial services
Government institutions
Defense organizations
Healthcare environments
Critical infrastructure
Environments subject to compliance audits

Missing or incomplete logs may make it difficult to detect malicious activity, perform forensic analysis, investigate incidents, and demonstrate compliance.

Required Fixed Versions

According to the Broadcom advisory, organizations should upgrade to the following versions or later:

Product	Current Branch	Required Fixed Version
VMware vCenter Server	9.1.x	9.1.0.0300 or later
VMware vCenter Server	9.0.x	9.0.2.0100 or later
VMware vCenter Server	8.0	8.0 Update 3k or later
VMware ESX	9.1.x	ESX 9.1.0.0200 or later
VMware ESX	9.0.x	ESX 9.0.2.0100 or later
VMware ESXi	8.0	ESXi 8.0 Update 3k or later
VMware Workstation	25H2	26H1 or later
VMware Fusion	25H2	26H1 or later

VMware security updates are generally cumulative.

This means that installing a release newer than the minimum fixed version should also include the security corrections delivered in earlier patches.

For example, even if a vulnerability was initially fixed in an earlier build, Broadcom may recommend a newer cumulative build as the preferred target version.

VMware Cloud Foundation 5.x environments may require an asynchronous patching process instead of the standard vSphere update method.

Organizations using VMware Telco Cloud Platform or VMware Telco Cloud Infrastructure should follow the product-specific update instructions published by Broadcom.

What About vSphere 7, 6.7, and 6.5?

VMware vSphere 7 reached the end of general support on October 2, 2025.

Broadcom indicates that vSphere 7 is affected by these vulnerabilities. Patches may be provided separately through the Broadcom Support Portal for offline import into Lifecycle Manager.

However, organizations should not consider this a long-term solution.

VMware vSphere 6.5 and 6.7 are also outside general support and are no longer tested as part of current Broadcom security advisories.

Broadcom recommends treating these legacy versions as potentially affected.

Organizations still operating vSphere 6.5, 6.7, or 7.0 should develop a migration plan to move to a fully supported VMware platform instead of relying only on temporary security fixes.

How to Check VMware Versions

Checking the ESX/ESXi Version with PowerCLI

After connecting to vCenter Server using PowerCLI, run the following command:

Get-VMHost | Select-Object Name, Version, Build

This command displays the hostname, VMware version, and build number of each ESX/ESXi host managed by the connected vCenter Server.

Checking the vCenter Server Version with PowerCLI

After connecting with Connect-VIServer, use the following variables:

$global:DefaultVIServer.Version
$global:DefaultVIServer.Build

The vCenter Server version and build information can also be viewed from the Summary page of the vCenter Server object in the vSphere Client.

Administrators should always compare both the version and the build number with the fixed versions listed in the Broadcom advisory.

Will Virtual Machines Be Affected During the Update?

vCenter Server Update

vCenter Server is the management layer of the VMware infrastructure. It is not the hypervisor component that directly runs virtual machines.

For this reason, running virtual machines and container workloads normally continue operating while vCenter Server is being updated.

However, the following services may be temporarily unavailable during the update:

vSphere Client access
vCenter API connections
Centralized management operations
Backup software integrations
Monitoring platform integrations
Automation tools
Provisioning operations
Third-party management integrations

Broadcom indicates that vCenter updates may be applied using standard update procedures or through the vCenter Server Appliance Management Interface, also known as VAMI.

ESX/ESXi Update

ESX/ESXi updates generally require the host to be restarted.

In a clustered environment, virtual machines can be migrated to other hosts using vMotion before the host is placed into maintenance mode.

The hosts can then be updated and restarted one at a time.

This approach is commonly known as a rolling reboot and can significantly reduce or eliminate service interruption.

Virtual machines that cannot be migrated with vMotion may need to be shut down before the host is restarted.

Certain ESX/ESXi and vCenter releases may support Live Patch or Quick Patch functionality.

However, administrators should not assume that every security update can be installed without a restart. The release notes and update documentation for the target build must always be reviewed.

Does VMware Tools Need to Be Updated?

The VMXNET3 driver is installed inside the guest operating system through VMware Tools or through drivers included with the operating system.

However, CVE-2026-47876 affects the ESX/ESXi-side implementation of VMXNET3 rather than only the guest operating system driver.

Therefore, updating VMware Tools alone is not sufficient to remediate this vulnerability.

The ESX/ESXi hosts must be updated.

VMware Tools should still be maintained as part of the organization’s normal lifecycle and security processes, but the primary remediation for VMSA-2026-0006 is the host update.

Recommended Pre-Update Checks

Before beginning the maintenance operation, administrators should complete the following checks:

Inventory all vCenter Server, ESX/ESXi, Workstation, and Fusion versions.
Verify that a current file-based backup of vCenter Server exists.
Confirm that the vCenter backup can be restored if necessary.
Review hardware compatibility for the target ESX/ESXi release.
Determine whether the servers require a vendor-specific custom image.
Review the VMware Product Interoperability Matrix.
Confirm compatibility between vCenter Server and ESX/ESXi.
Validate compatibility with backup, replication, monitoring, and disaster recovery products.
Confirm that the cluster has enough capacity to operate while one host is in maintenance mode.
Test DRS, HA, vMotion, datastore connectivity, and network connectivity.
Review firmware and driver requirements.
Prepare a validation plan for the period after the update.
Prepare a documented rollback or recovery procedure.
Notify the relevant technical teams and business units about the maintenance activity.

Special care is required for integrated or hyperconverged platforms such as:

Dell VxRail
HPE SimpliVity
Vendor-certified VMware appliances
Customized OEM ESX/ESXi images

Administrators should not install a generic VMware patch directly on these platforms unless the hardware vendor has approved the update.

The vendor-supported bundle and update procedure should be used to avoid compatibility, firmware, driver, and supportability issues.

Recommended Update Sequence

The exact process may vary depending on the architecture, but a typical maintenance sequence can be planned as follows:

Review VMware and third-party product compatibility.
Take a current vCenter Server backup.
Verify that the backup is usable.
Upgrade vCenter Server to a fixed version.
Verify vCenter services and administrative access.
Confirm that the inventory, clusters, hosts, datastores, and networks are visible.
Select the first ESX/ESXi host for maintenance.
Migrate virtual machines to other hosts using vMotion.
Place the host into maintenance mode.
Apply the required ESX/ESXi update.
Restart the host if required.
Verify management, storage, network, and vCenter connectivity.
Exit maintenance mode.
Confirm that DRS and HA are operating normally.
Repeat the same process for the remaining hosts.
Upgrade VMware Workstation and VMware Fusion systems to 26H1 or later.
Validate backup, replication, monitoring, and automation integrations.
Review alarms, logs, and system health.
Document the final version and build numbers.

This staged approach reduces operational risk and makes it easier to identify problems before all hosts are updated.

Is There Evidence of Active Exploitation?

According to Broadcom’s statement published on July 29, 2026, there was no confirmed information at that time showing that these vulnerabilities were being actively exploited in real-world attacks.

However, this should not be interpreted as a reason to delay patching.

The vCenter vulnerabilities have CVSS scores of 9.8 and can potentially be exploited without authentication.

Once technical details or proof-of-concept code become available, threat actors may begin scanning for vulnerable systems.

Broadcom recommends treating these updates as an emergency change within an ITIL-based change management process.

Temporary Risk-Reduction Measures

Although no official workaround is available, organizations can reduce exposure until patching is completed.

Recommended measures include:

Restrict vCenter access to dedicated management networks.
Block direct internet access to vCenter Server.
Limit ESX/ESXi management access to authorized administrator systems.
Use firewall rules and access control lists.
Enforce multi-factor authentication where supported.
Review privileged user accounts.
Disable unused administrative accounts.
Monitor failed authentication attempts.
Review vCenter and ESX/ESXi logs.
Segment backup, management, storage, and virtual machine networks.
Prevent regular user networks from accessing management interfaces.
Use secure jump servers for administrative access.
Monitor unusual virtual machine deployment or configuration activity.

These controls may reduce the likelihood of exploitation, but they do not eliminate the vulnerabilities.

They should not be considered a replacement for the official security updates.

VMSA-2026-0006 is one of the most important VMware security advisories released in recent years.

The authentication bypass and remote code execution vulnerabilities affecting vCenter Server may allow attackers to compromise the central management layer of a VMware environment.

The VMXNET3 vulnerability is also highly significant because it may allow an attacker with administrative privileges inside a virtual machine to escape the guest environment and execute code on the ESX/ESXi host.

There are no official workarounds for these vulnerabilities.

Network segmentation, firewall restrictions, and limited administrative access may reduce the risk, but they cannot replace the required patches.

Organizations using VMware infrastructure should immediately review their version and build numbers, prepare an emergency maintenance plan, and upgrade vCenter Server, ESX/ESXi, VMware Workstation, and VMware Fusion to the fixed versions specified by Broadcom.