VMware CVE-2026-59309: Critical vCenter Auth Bypass Chains Into VM Escape

VMware CVE-2026-59309 is a CVSS 9.8 authentication-bypass flaw in vCenter Server that lets an unauthenticated attacker take over the management plane of a vSphere estate — and Broadcom disclosed it alongside CVE-2026-59310 (a 9.8 directory-traversal RCE) and CVE-2026-47876 (a 9.3 VMXNET3 virtual-machine escape) in advisory VMSA-2026-0006. There are no workarounds; patching is the only fix. Together the three bugs give an attacker a path from a single guest VM all the way to full infrastructure compromise, which is why defenders are treating this as an emergency-maintenance event rather than a routine patch cycle.

The auth-bypass (CVE-2026-59309, CWE-303) and the path-traversal RCE (CVE-2026-59310, CWE-22) both sit in vCenter and are network-reachable with no credentials, so an attacker who can see a vCenter's management ports can authenticate as no one and execute code as the platform. The third flaw, CVE-2026-47876 (CWE-787, an out-of-bounds write in the VMXNET3 virtual network adapter), works from the other direction: code running inside a guest VM can break out to the ESXi host. Stacked together, a foothold in one tenant VM becomes host execution, and unauthenticated vCenter takeover becomes control of every host it manages. Broadcom credited its own researchers and, at disclosure, reported no evidence of exploitation in the wild — but that window rarely stays open.

Which VMware products and versions are affected?

The flaws span vCenter Server, ESXi, VMware Workstation and Fusion, and the packaged stacks — VMware Cloud Foundation, vSphere Foundation, and Telco Cloud — that bundle them. Broadcom has stated there are no mitigations or workarounds, so the fixed builds below are mandatory.

Why are defenders more worried than the "no exploitation yet" line suggests?

Because the community read is that weaponization is a matter of days, not months. Reverse engineers on Hacker News and infosec Twitter note that an authentication bypass in the directory service and a path traversal in the syslog handler are exactly the kind of bugs that are easy to diff from the patch and turn into a working exploit, and researchers expect mass Shodan and Censys scanning for exposed vCenter ports (443, 389, 636, 2012) followed by public PoCs. On r/sysadmin the friction is operational rather than technical: teams report trouble pulling patch binaries for legacy or license-limited deployments through Broadcom's portal, which slows the exact emergency patching this situation demands. The most-asked practical questions are the patching order (patch vCenter before ESXi hosts) and what vmdir or syslog log entries would reveal a bypass attempt.

Our read

VMware infrastructure is the flat, high-value core that annual pentests routinely never reach — and it is a standing favorite of both ransomware crews and state actors. In our analysis of 2025's actively exploited vulnerabilities, 67% would have been missed by a once-a-year pentest, and the disclosure-to-exploitation gap has a median of just 26 days; a chainable 9.8 in vCenter is precisely the profile that closes that gap fastest. Continuous verification means an exposed vCenter management port is caught and confirmed the day the advisory drops — not at the next scheduled test, by which time a public PoC is already scanning for you.

Reporting by BleepingComputer and Broadcom's VMSA-2026-0006 advisory; CVSS and CWE data per NVD. Sources linked above.

Related: Cisco FMC CVE-2026-20316: static-credential zero-day in KEV · What CVSS and EPSS miss for patch prioritization

Frequently asked questions

Is CVE-2026-59309 being exploited in the wild?
Not at disclosure, per Broadcom. But security researchers expect rapid exploit development because the patched components are easy to reverse-engineer, and mass scanning for exposed vCenter is anticipated. Treat it as pre-exploitation, not safe.

Is there a workaround if I can't patch immediately?
No. Broadcom explicitly states there are no workarounds or mitigations. The only remediation is upgrading to the fixed builds. If you cannot patch at once, restrict vCenter management interfaces to out-of-band networks and block ports 443/389/636/2012 from untrusted subnets as a stopgap.

What's the correct patching order?
Patch vCenter Server first (it manages the fleet), then the ESXi hosts, then Workstation/Fusion endpoints. Confirm your deployment train (8.0 U3k vs 9.0.2 vs 9.1) before applying builds.

Why is the VMXNET3 flaw so serious if it needs code in a guest VM?
Because it converts any single compromised or malicious VM into a foothold on the ESXi host, and from a host an attacker can pivot across the cluster. Chained with the vCenter bugs it removes the isolation boundary the whole virtualization model depends on.