Broadcom has patched five vulnerabilities across its VMware lineup, and anyone running vSphere in production should look at this today, not after the weekend. Three of the five carry a critical rating.
The most alarming one, CVE-2026-59309, hits VMware Directory Service and could let an attacker skip authentication entirely when logging into vCenter. No password, no MFA prompt, just a way in.
Next is CVE-2026-47876, an out-of-bounds write bug in ESXi’s VMXNET3 virtual network adapter. If someone exploits it, they could run their own code directly on the host machine. At least the damage stays contained to that specific adapter; other virtual network configurations aren’t affected.
The third critical flaw, CVE-2026-59310, sits in vCenter’s Syslog server. Anyone with network access could use it to execute arbitrary code, so it’s worth double-checking network segmentation this week rather than assuming it’s fine.
Broadcom rated the fourth issue, CVE-2026-41703, as high instead of critical, though it actually spans several vulnerabilities across ESX, vCenter, Workstation, and Fusion. An attacker with VM deployment privileges could trigger an out-of-bounds read, and depending on what’s sitting in memory nearby, that could mean data leaking out or the host process crashing.
The last one, CVE-2026-41709, sounds almost minor by comparison: ESX just isn’t logging enough activity. But that gap matters, because a rogue administrator could quietly make changes and leave barely a trace.
Altogether, the affected products cover a wide slice of Broadcom’s portfolio: ESX, vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation, and both Telco Cloud products. Since so many organizations run VMware somewhere in their stack, that’s a long list of environments worth reviewing.
Patches for all five issues are already live in Broadcom’s VMSA-2026-0006 advisory, so there’s no reason to wait to apply them.
