VMware patches host escape bugs in Workstation and Fusion

Broadcom published VMware Security Advisory VMSA-2026-0007 on 3 September 2026, a Critical notice for Workstation and Fusion. The advisory scores the pair at CVSS 8.1 to 9.3 and ships one fixed build, 26H1u1. The two CVE IDs are not on CISA's Known Exploited Vulnerabilities list in the notice.

CVE-2026-59346 is a VMXNET3 integer overflow, Critical at 9.3, so an actor with local admin on a guest that uses the VMXNET3 adapter may execute code on the host. CVE-2026-59347 is an HGFS stack buffer overflow, Important at 8.1, so local admin on a guest may execute code as that VM's VMX process on the host. HGFS is the shared-folders path.

Both bugs hit Workstation 25H2 and 26H1 on any OS, and Fusion 25H2 and 26H1 on macOS. Broadcom lists no workarounds for either CVE. Labs that leave HGFS or VMXNET3 on untrusted guests have only the 26H1u1 bump.

The advisory says both issues were privately reported. It does not claim exploitation in the wild. SecurityWeek notes that many other VMware defects already sit on CISA's KEV list. That background is about the product family, not a claim about CVE-2026-59346 or CVE-2026-59347. The closer cousin on Cyberpresso is the Cisco Nexus 9000 Silicon One root RCE: a vendor critical with a patch and no public wild-use claim in the notice itself.

Some offers on this page may be paid placements or contain affiliate links.