This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] VMWare fixes 5 vulnerabilities
Broadcom fixes five vulnerabilities in VMware ESX, vCenter, Workstation, Fusion, vSphere Foundation, Cloud Foundation, Telco Cloud Platform and Telco Cloud Infrastructure, three of which are critical and one is important. Another, less severe vulnerability (CVE-2026-41709) was also fixed and its details are available at [1]. The 4 more severe vulnerabilities are listed below. Fixed versions: [1] VMware vCenter - 8.0 U3k, 9.0.2.0100, 9.1.0.0300 VMware ESX - 8.0 U3k, 9.0.2.0100, 9.1.0.0200 VMware vSphere Foundation - 9.0.2.0100, 9.1.0.0300, VMware Workstation - 26H1 VMware Fusion - 26H1 VMware Cloud Foundation - 5.2.4 with the patch applied, 9.0.2.0100, 9.1.0.0300 VMware Telco Cloud Platform - KB449886 [2] VMware Telco Cloud Infrastructure - KB449886 [2]
An unauthenticated remote attacker with access to vCenter can bypass authentication in VMware Directory Service and gain unauthorized access to the system. [1]
The vulnerability is present in products:
- VMware vCenter; >=8.0, <8.0 U3k;
- VMware vSphere Foundation; >=9.0, <9.0.2.0100; >=9.1, <9.1.0.0200;
- VMware Cloud Foundation; >=5.0, <=5.2; >=9.0, <9.0.2.0100; >=9.1, <9.1.0.0300;
- VMware Telco Cloud Platform; ==3.0; ==4.0; >=5.0, <=5.0.2; ==5.1;
- VMware Telco Cloud Infrastructure; ==3.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-59309 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
An unauthenticated remote attacker with access to vCenter can execute arbitrary code through directory traversal in the Syslog server. [1]
The vulnerability is present in products:
- VMware vCenter; >=8.0, <8.0 U3k;
- VMware vSphere Foundation; >=9.0, <9.0.2.0100; >=9.1, <9.1.0.0300;
- VMware Cloud Foundation; >=5.0, <=5.2; >=9.0, <9.0.2.0100; >=9.1, <9.1.0.0300;
- VMware Telco Cloud Platform; ==3.0; ==4.0; >=5.0, <=5.0.2; ==5.1;
- VMware Telco Cloud Infrastructure; ==3.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-59310 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
A local attacker without privileges on the ESX host who is an administrator of a virtual machine with a VMXNET3 adapter can write out of array bounds and execute code on the ESX host - this is a VM escape. [1]
The vulnerability is present in products:
- VMware ESX; >=8.0, <8.0 U3k-25595708;
- VMware vSphere Foundation; >=9.0, <9.0.2.0100-25595025; >=9.1, <9.1.0.0200-25557999;
- VMware Cloud Foundation; >=9.0, <9.0.2.0100-25595025; >=9.1, <9.1.0.0200-25557999;
- VMware Telco Cloud Platform; >=5.0, <=5.0.2; ==5.1;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-47876 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
An authenticated remote attacker with VM deployment privileges can cause an out-of-bounds memory read leading to information disclosure or a DoS of the host process. [1]
The vulnerability is present in products:
- VMware ESX; >=8.0, <8.0 U3i;
- VMware vSphere Foundation; >=9.0, <9.0.2.0100-25595025; >=9.1, <9.1.0.0200-25557999;
- VMware Cloud Foundation; >=5.0, <5.2.3; >=9.0, <9.0.2.0100-25595025; >=9.1, <9.1.0.0200-25557999;
- VMware Telco Cloud Platform; >=5.0, <=5.0.2; ==5.1;
- VMware Workstation; ==25H2;
- VMware Fusion; ==25H2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
More information:
- CVE-2026-41703 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
Links
By CESNET, z.s.p.o. Jakub Maloštík on 30. 7. 2026.