If you run VMware Workstation or VMware Fusion on your machine, you need to stop and check your version today. Broadcom just disclosed two serious security flaws that let an attacker break out of a virtual machine and run code directly on your host computer. One of these flaws carries a near-maximum severity score. This post breaks down what happened, who is affected, and exactly how to protect your systems, step by step.

Table of Contents

1. What Happened
2. CVE-2026-59346: The VMXNET3 Integer Overflow
3. CVE-2026-59347: The HGFS Buffer Overflow
4. Who Is Affected
5. Why VM Escape Vulnerabilities Matter So Much
6. How to Check Your Current Version
7. How to Patch: Step-by-Step
8. Interim Risk Reduction (If You Can’t Patch Immediately)
9. Is This Being Exploited in the Wild?
10. Frequently Asked Questions
11. Conclusion

What Happened

On September 3, 2026, Broadcom published security advisory VMSA-2026-0007, covering two vulnerabilities in VMware Workstation and VMware Fusion. The advisory details two vulnerabilities affecting VMware’s widely used desktop virtualization products.

Both products let you run a full virtual computer inside your real one. Normally, a strong wall separates the two: nothing inside the VM should be able to touch the host machine. These new flaws break part of that wall.

Security researchers reported both bugs privately, and Broadcom reports both issues were disclosed privately and states there are no known workarounds. That last point matters. Usually, when a company publishes a security advisory, it also offers a temporary fix you can apply while you plan a full update. Not this time.

Show Image Suggested image title: “vmware-workstation-security-patch-alert” — Alt text: “Laptop screen showing a VMware Workstation critical security update notification”

CVE-2026-59346: The VMXNET3 Integer Overflow

This is the more dangerous of the two bugs, and it sits inside VMXNET3, the virtual network card that VMware Workstation and Fusion give to virtual machines.

An integer overflow happens when a program tries to store a number that is too large for the space it has, causing the value to wrap around unexpectedly. Attackers can sometimes use this kind of miscalculation to corrupt memory and eventually run their own code.

Broadcom describes the flaw as an integer overflow bug leading to arbitrary code execution, and warns that a malicious actor with local administrative privileges on a virtual machine with a VMXNET3 virtual network adapter could exploit it. Broadcom rates CVE-2026-59346 at a maximum CVSSv3 score of 9.3, placing it firmly in the critical range.

In plain terms: someone who already has admin rights inside your VM can use this bug to jump outside the VM and take control of the physical machine running it.

Researchers h4urek from secsys lab, along with Y² and Stan S working through Trend Micro’s Zero Day Initiative, each reported this issue to Broadcom independently, according to multiple advisories tracking the disclosure.

CVE-2026-59347: The HGFS Buffer Overflow

The second flaw lives inside HGFS, the Host-Guest File System that VMware uses to share folders between your virtual machine and your real computer.

CVE-2026-59347 is a stack-based buffer-overflow vulnerability that carries a CVSS score of 8.1 and is classified as important rather than critical. A buffer overflow happens when a program writes more data into a block of memory than that block was designed to hold, which can let an attacker overwrite nearby memory and hijack program execution.

An attacker with local administrative privileges on a virtual machine can exploit this bug to execute code as the virtual machine’s VMX process running on the host. The VMX process is the core component that manages a running virtual machine, so gaining code execution at that level gives an attacker a serious foothold on the host.

Tencent’s Xuanwu Lab researchers Yeonghyeon Choi and Tianchu Chen are credited with reporting this vulnerability.

Who Is Affected

Both flaws affect VMware Workstation versions 25H2 and 26H1 running on any host operating system, as well as VMware Fusion versions 25H2 and 26H1 running on macOS.

That means the bugs are not limited to Windows or Linux hosts. If you run Fusion on a Mac to spin up Windows or Linux virtual machines, you are just as exposed as a Windows or Linux user running Workstation.

Broadcom has already shipped the fix. Broadcom has released version 26H1u1 to remediate both flaws across the affected product lines.

Quick Affected-Versions Table

Product	Vulnerable Versions	Fixed Version
VMware Workstation	25H2, 26H1	26H1u1
VMware Fusion (macOS)	25H2, 26H1	26H1u1

Why VM Escape Vulnerabilities Matter So Much

Virtualization exists to create isolation. Companies run untrusted code, test malware samples, or host multiple customers’ workloads on shared hardware, all relying on the assumption that a compromised VM stays contained.

A VM escape flaw breaks that assumption entirely. Once an attacker steps out of the guest and onto the host, they can potentially reach every other VM running on that same machine, access host files, or pivot further into your network.

This risk grows in specific environments: shared development labs, contractor laptops, nested test environments, or any setup where multiple people or teams have admin access inside VMs but shouldn’t have access to the host. In a shared lab, a contractor’s dev box, or a nested-test environment, local admin rights inside a guest are not a high bar for an attacker to clear.

Show Image Suggested image title: “vm-escape-attack-diagram” — Alt text: “Diagram illustrating how a VM escape vulnerability lets an attacker move from a virtual machine to the host operating system”

How to Check Your Current Version

Before you patch anything, confirm which version you are running.

On Windows or Linux (VMware Workstation)

Open a command prompt or terminal and run:

vmware -v

Or check from the graphical interface: open VMware Workstation, then go to Help > About VMware Workstation.

On macOS (VMware Fusion)

From the menu bar, click VMware Fusion > About VMware Fusion.

Or run this in Terminal:

/Applications/VMware\ Fusion.app/Contents/Library/vmware-vmx -v

If the version reported is 25H2 or 26H1 (and not 26H1u1 or later), your installation is vulnerable and needs an update.

How to Patch: Step-by-Step

Step 1: Back Up Your Virtual Machines

Before any major update, snapshot or back up your active VMs. This protects you if anything goes wrong during the upgrade.

Step 2: Download the Fixed Build

Go to Broadcom’s official support portal and download VMware Workstation or Fusion version 26H1u1 or later. Always download updates from Broadcom’s official site, never from a third-party mirror.

Step 3: Close Running VMs

Shut down all running virtual machines before installing the update.

# Example: gracefully shut down a VM from the CLI (Workstation Pro)
vmrun stop "C:\VMs\MyVM\MyVM.vmx" soft

Step 4: Install the Update

Windows: Run the downloaded installer and follow the prompts. A restart may be required.

macOS: Open the downloaded .dmg file and drag the new VMware Fusion version over your Applications folder, replacing the old one.

Linux: Run the official bundle installer with root privileges:

sudo sh VMware-Workstation-26H1u1-xxxxxx.x86_64.bundle

Step 5: Verify the Update

Re-run the version check command from the previous section and confirm it now shows 26H1u1 or later.

vmware -v

Step 6: Restart Your VMs and Confirm Normal Operation

Boot your virtual machines back up and confirm shared folders (HGFS) and network adapters (VMXNET3) still function as expected.

Interim Risk Reduction (If You Can’t Patch Immediately)

Broadcom has confirmed there is no official workaround, but if you cannot patch right away for operational reasons, you can reduce your exposure:

• Limit local admin rights inside guest VMs to only the people who strictly need them.
• Avoid VMXNET3 where possible; switch temporarily to a different virtual network adapter type for high-risk VMs.
• Disable HGFS shared folders on VMs that do not need file sharing with the host.
• Restrict physical or remote access to hosts running vulnerable Workstation or Fusion builds.

These steps only reduce risk. They do not close the vulnerability. Patching remains the only real fix.

Is This Being Exploited in the Wild?

As of the advisory’s publication, there is no confirmed evidence of active exploitation. Broadcom also notes it has not observed these specific vulnerabilities being exploited in the wild.

That said, VMware products have a track record of being targeted quickly once a patch reveals what was broken. Just last month, threat actors were actively exploiting separate flaws in VMware vCenter, with one suspected China-linked group weaponizing the bug within days of public disclosure and breaching hundreds of victim IP addresses across dozens of countries. Attackers routinely reverse-engineer official patches to build working exploits, so the safe window for delaying an update is short.

A Broader Pattern Worth Watching

This is not the first time a VMXNET3-related flaw has surfaced. Security researchers tracking VMware’s advisory history note that Broadcom patched a separate VMXNET3 issue just a month before this disclosure. That repetition suggests attackers and researchers alike are giving virtual network adapters closer scrutiny, and it means administrators should treat VMXNET3 as a component worth monitoring going forward, not just a one-time fix.

The same week this advisory landed, CISA added several unrelated but actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. That pace is a useful reminder: the gap between “patch available” and “exploit in the wild” keeps shrinking across the industry, not just for VMware. Waiting a few weeks to apply a critical update is no longer a low-risk choice.

Building a Habit, Not Just Applying One Patch

Treat this incident as a prompt to tighten your update process, not just fix one issue. A few habits make the next advisory easier to handle:

• Subscribe to Broadcom’s security advisory feed so new VMSA bulletins reach your inbox the day they publish.
• Maintain an inventory of every machine running Workstation or Fusion, including personal laptops used for development work.
• Test updates in a staging environment first if you manage VMs in a business setting, then roll out to production hosts quickly once validated.
• Review who holds local admin rights inside your VMs on a regular schedule, since both flaws in this advisory depend on that access existing in the first place.

None of these steps require special tooling. They just require treating virtualization software with the same patching discipline you would apply to any internet-facing server.

Frequently Asked Questions

Q: Do I need to update if I never use shared folders or VMXNET3? A: You are still safer updating regardless. Configurations change over time, and leaving unpatched software in place carries risk even if a specific feature is currently unused.

Q: Can an attacker exploit this remotely without any access to my VM? A: No. Both flaws require the attacker to already have local administrative privileges inside a virtual machine. This is not a remote, no-interaction exploit, but a VM-escape path once that access is obtained.

Q: Does this affect VMware ESXi or vSphere? A: No. This advisory covers VMware Workstation and VMware Fusion specifically, the desktop virtualization products. Broadcom’s enterprise hypervisors are covered under separate advisories when relevant.

Q: Is the fix free? A: Yes. Version 26H1u1 is a standard security update available to existing Workstation and Fusion license holders through Broadcom’s support portal.

Q: What if I run an older version like 24H2? A: Check Broadcom’s advisory for the full list of affected and fixed builds, since older release lines may require a different upgrade path. When in doubt, upgrade to the latest supported version.

Conclusion

Broadcom’s September 2026 advisory covers two vulnerabilities in VMware Workstation and Fusion that together allow a VM-level attacker to break out onto the host machine. CVE-2026-59346, an integer overflow in the VMXNET3 network adapter, scores a critical 9.3 on the CVSS scale. CVE-2026-59347, a buffer overflow in the HGFS shared-folder component, scores 8.1.

Both affect versions 25H2 and 26H1 of Workstation and Fusion, with no available workaround. The fix is version 26H1u1, and Broadcom has not reported active exploitation so far. That window will not stay open indefinitely. If you manage any host running VMware Workstation or Fusion, check your version today and schedule the update as a priority, not an afterthought.