VMSA-2026-0006: VMware vCenter authentication bypass and ESXi VM escape — three critical CVEs

Broadcom patches three critical VMware flaws: vCenter authentication bypass, Syslog directory-traversal RCE, and ESXi VMXNET3 VM escape. Highest CVSS 9.8. Unauthenticated attackers can fully control the virtualization stack. No workaround.

Incident overview

On 29 July 2026, Broadcom published advisory VMSA-2026-0006, patching five flaws in the VMware virtualization stack. Three are Critical. The two most severe, CVE-2026-59309 (vCenter authentication bypass) and CVE-2026-59310 (vCenter Syslog directory-traversal RCE), both score CVSS 9.8 (Critical) and need no authentication.

Also patched: CVE-2026-47876, an ESXi VMXNET3 out-of-bounds write (CVSS 9.3). A guest with local admin can break VM isolation and run code on the ESXi host — VM escape. Broadcom states there is no workaround. Patching is the only path.

Technical details

Three Critical CVEs

| CVE | Component | Type | CVSS v3.1 | Impact | |---|---|---|---|---| | CVE-2026-59309 | vCenter Directory Service | Authentication bypass | 9.8 (Critical) | Unauthenticated access to the vCenter management plane | | CVE-2026-59310 | vCenter Syslog service | Directory traversal → RCE | 9.8 (Critical) | Unauthenticated remote code execution | | CVE-2026-47876 | ESXi VMXNET3 driver | Out-of-bounds write → VM escape | 9.3 (Critical) | Guest → host code execution |

CVE-2026-59309: vCenter authentication bypass

The flaw is in VMware Directory Service on vCenter. Network reachability to vCenter is enough — no credentials. Full authentication bypass and unauthorized access to the vSphere management plane.

vCenter is the control plane for ESXi hosts, VMs, networking, and storage. With the bypass an attacker can:

• Manage all registered ESXi hosts and VMs
• Access VM consoles and change virtual hardware
• Steal or destroy VMDKs on datastores
• Plant persistence in the virtualization stack

CVE-2026-59310: vCenter Syslog directory-traversal RCE

In the vCenter Syslog server. Weak path validation on user input allows directory traversal and arbitrary code execution. Unauthenticated. Low attack complexity.

CVE-2026-47876: ESXi VMXNET3 VM escape

In the ESXi VMXNET3 virtual NIC driver. Requires local admin in the guest. An out-of-bounds write then yields code execution on the ESXi host and breaks isolation.

Especially dangerous in multi-tenant setups:

• Cloud: one compromised customer VM can hit the host and other tenants
• Enterprise: a compromised dev/test VM can hit production ESXi
• Host compromise puts every VM on that host under attacker control

Affected VMware products

• VMware vCenter Server (9.1.x.x, 9.0.x.x, 8.0)
• VMware ESX (8.0, 9.0, 9.1)
• VMware Workstation
• VMware Fusion
• VMware Cloud Foundation (5.x, 9.0.x.x, 9.1.x.x)
• VMware vSphere Foundation (9.0.x.x, 9.1.x.x)
• VMware Telco Cloud Platform (3.0, 4.x, 5.0.x, 5.1.x)
• VMware Telco Cloud Infrastructure (3.0)

Impact

• Unauthenticated: both vCenter bugs have a low bar. Anyone who can reach the vCenter network can try them.
• Control plane loss: a compromised vCenter is full control of the virtualization stack.
• Attacker preference: vCenter Server has landed in the CISA KEV catalog 10 times.
• No workaround: Broadcom states none of the Critical issues have a workaround. Patch only.
• Virtualization is the datacenter backbone: most core enterprise workloads sit on VMware. These bugs hit that layer.

Remediation

vCenter Server upgrades

| Current | Fixed | |---|---| | vCenter 9.1.x.x | 9.1.0.0300 | | vCenter 9.0.x.x | 9.0.2.0100 | | vCenter 8.0 | 8.0 U3k | | VMware Cloud Foundation (vCenter 5.x) | 8.0 U3k async patch |

ESXi upgrades

• ESXi 9.1.x: upgrade to ESXi-9.1.0.0200-25557999
• ESXi 9.0.x: upgrade to ESXi-9.0.2.0100-25595025
• ESXi 8.0: upgrade to ESXi80U3k-25595708

Emergency mitigations

• Network isolation: put the vCenter management interface on a dedicated management network. Block direct access from production networks and the internet.
• Disable VMXNET3: if ESXi cannot be patched immediately, switch VM NICs to E1000 or any type other than VMXNET3 (may hurt performance).
• Monitoring: enable verbose authentication and Syslog on vCenter. Deploy UEBA for anomalous admin actions.
• Change audit: review recent vCenter config changes, VM create/delete, and ESXi host add/remove.

Defense in depth

• Treat the virtualization control plane as a critical asset.
• Strong change approval and MFA on vCenter.
• Periodic pentest and red-team of the virtualization environment.
• Patch SLA that lands Critical VMware fixes within days.

References

• Broadcom VMSA-2026-0006: VMware ESX, vCenter, Workstation, Fusion multi-vulnerability advisory
• Rapid7: VMware vCenter critical vulnerability analysis
• Cybersecurity News: VMware vCenter critical vulnerability details
• Western Australia WASOC: VMware multiple critical vulnerability alert