Critical VM Escape Vulnerability Patched in VMware ESXi

Broadcom published a new security advisory on Wednesday informing VMware product users that patches are available for several vulnerabilities affecting ESXi vCenter Workstation and Fusion. Three of the vulnerabilities have been assigned a critical severity rating. One of them is CVE-2026-47876 an out-of-bounds write issue in ESXi's VMXNET3 virtual network adapter. An attacker with local admin privileges on a VM with this adapter can exploit it to execute arbitrary code on the host. CVE-2026-47876 has been described by VMware as a VM escape. The second critical flaw CVE-2026-59309 is a vCenter authentication bypass that can be exploited to gain unauthorized access to the targeted system. CVE-2026-59310 is also a critical vCenter vulnerability allowing an attacker with network access to execute arbitrary code. VMware ESXi Workstation and Fusion are affected by CVE-2026-41703 a high-severity vulnerability that allows an attacker with VM deployment permissions to obtain information or more likely cause a DoS condition on the host process. The last flaw CVE-2026-41709 is a low-severity issue in ESXi that allows an attacker with admin privileges to conduct certain activities without being logged. Broadcom is not aware of the in-the-wild exploitation of these vulnerabilities but it's important that organizations install the latest updates as threat actors often exploit flaws in VMware products. In addition to its advisory the vendor has published an FAQ detailing the impact of the vulnerabilities and patching requirements.