Patch Now! Two Actively Exploited CVEs Affecting VMware vCenter Server and More
Broadcom published VMSA-2026-0006 on July 29th, 2026, to address five vulnerabilities affecting VMware ESX, VMware vCenter Server, VMware Workstation, and VMware Fusion. The highest-risk issues are CVE-2026-59309 (CVSS 9.8) and CVE-2026-59310 (CVSS 9.8) affecting VMware vCenter Server. Both can be exploited by an unauthenticated attacker with network access to achieve remote code execution (RCE).
Technical details for CVE-2026-59310 and CVE-2026-59309 were published immediately after their disclosure, but no proof-of-concept exploits are publicly available. On August 11th, Defused Cyber reported probing for CVE-2026-59309. QUIRSO GmbH reports that in-the-wild exploitation of CVE-2026-59309 and CVE-2026-59310 is already underway [1][2][3]. Neither CVE is on CISA’s Known Exploited Vulnerabilities (KEV) list. Numerous national CERT agencies have issued alerts [4][5][6][7][8][9][10][11][12][13][14][15][16][17][18].
The VMSA-2026-0006 advisory also disclosed three additional flaws. CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write flaw affecting the ESX VMXNET3 network adapter. Exploitation can allow a guest administrator to execute code on the host. The other two flaws are CVE-2026-41703 (CVSS 7.6) affecting VMware ESX, Workstation, and Fusion, and CVE-2026-41709 (CVSS 2.7) affecting ESX.
Start Your Free Trial
Greenbone’s OPENVAS ENTERPRISE FEED addresses CVE-2026-59309 and CVE-2026-59310 with a remote banner version check for VMware vCenter Server. It also includes VMware ESXi package-level detection for CVE-2026-41703 [1], CVE-2026-47876 [2], and CVE-2026-41709 [3]. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.
A Risk Assessment of VMware vCenter and ESX Vulnerabilities in VMSA-2026-0006
Technical details for CVE-2026-59310 and CVE-2026-59309 affecting VMware vCenter Server were published immediately after their disclosure, but no proof-of-concept exploits are publicly available. Both CVEs can be exploited remotely by an attacker without authentication. Public reporting indicates that in-the-wild exploitation of both CVEs is already underway [1][2][3].
VMware vCenter Server poses high risk because it provides centralized management of virtualized hosts and virtual machines from a single console. In practical terms, a compromise of VMware vCenter Server can affect a management layer for critical virtual machine hosts and workloads.
The ESX issues present a different but still important risk profile. CVE-2026-47876 requires local administrative control inside a guest VM that uses the VMXNET3 adapter. However, the consequence is high—host-level code execution. CVE-2026-41703 requires VM deployment privileges and can cause information disclosure or trigger a Denial of Service (DoS) condition in the host process. CVE-2026-41709 is low severity, but it weakens audit visibility by allowing certain administrator actions to bypass logging.
CVE-2026-59309: Actively Exploited vCenter Authentication Bypass
CVSS 9.8 · CriticalActively exploited
An attacker with network access to VMware vCenter Server can bypass authentication and gain unauthorized access to the system. The root cause is incorrect implementation of an authentication algorithm [CWE-303]. The flaw affects the VMware Directory Service.
CVE-2026-59310: Actively Exploited vCenter Directory Traversal RCE
CVSS 9.8 · CriticalActively exploited
A directory traversal flaw in the VMware vCenter Server Syslog component allows an unauthenticated remote attacker to execute arbitrary code. The root cause is improper limitation of a pathname to a restricted directory [CWE-22].
Other CVEs Disclosed in VMSA-2026-0006
The VMSA-2026-0006 advisory also disclosed three additional, lower-severity flaws affecting VMware ESX, Workstation, and Fusion:
The three additional CVEs disclosed in VMSA-2026-0006, each shown with its CVSS severity band and EPSS exploitation-probability score
A critical out-of-bounds memory write condition [CWE-787] in the VMware ESX VMXNET3 virtual network adapter. Exploitation allows an attacker with local admin privileges on a VM to execute code on the ESX host. The flaw only affects guest VMs using the default VMXNET3 adapter. Other network adapters are not reported to be affected by CVE-2026-47876.
An out-of-bounds read flaw [CWE-125] that allows information disclosure or DoS of the host process. Exploitation requires VM deployment privileges. CVE-2026-41703 affects VMware ESX as well as VMware Workstation and Fusion. Broadcom reports that the impact on VMware Workstation and VMware Fusion is restricted to information disclosure.
A low-severity issue in VMware ESX causes certain operations not to be logged [CWE-778].
Mitigation for CVEs Disclosed in VMSA-2026-0006
Organizations should map their installed versions to the affected and fixed releases in Broadcom’s VMSA-2026-0006 advisory and apply the vendor-provided updates. No workarounds are available for any of the CVEs.
CVE-2026-59309 and CVE-2026-59310 are the most urgent because both are exploitable to an unauthenticated attacker with network access to an affected VMware vCenter instance. CVE-2026-47876 should be prioritized where VMware ESX guest VMs use the VMXNET3 adapter because exploitation allows virtual machine escape and code execution on the ESX host. CVE-2026-41703 should have increased priority for VMware ESX instances that manage critical operations since it can be exploited to trigger DoS conditions. The VMware ESX flaw CVE-2026-41709 should be patched where audit completeness is important.
Summary
Broadcom’s VMSA-2026-0006 bundles five VMware vulnerabilities across VMware vCenter Server, VMware ESX, VMware Workstation, and VMware Fusion. The highest-risk exposure is concentrated in CVE-2026-59310 and CVE-2026-59309. Both are critical-severity and actively exploited flaws affecting VMware vCenter Server [1][2][3].
Greenbone’s OPENVAS ENTERPRISE FEED addresses CVE-2026-59309 and CVE-2026-59310 with a remote banner version check for VMware vCenter Server. It also includes VMware ESXi package-level detection for CVE-2026-41703 [1], CVE-2026-47876 [2], and CVE-2026-41709 [3]. For defenders seeking to detect and protect, a trial copy of OPENVAS SCAN includes a free two-week trial of the OPENVAS ENTERPRISE FEED. Greenbone’s cyber security products are a surefire way to gain the deepest insight into where software vulnerabilities exist across your organization’s infrastructure.
Joseph has had a varied and passionate background in IT and cyber security since the late 1980s. His early technical experience included working on an IBM PS/2, assembling PCs and programming in C++.
He also pursued academic studies in computer and systems engineering, anthropology and an MBA in technology forecasting.
Joseph has worked in data analytics, software development and, in particular, enterprise IT security. He specialises in vulnerability management, encryption and penetration testing.
