VMware Desktop Virtualization Bugs Put Developer and Admin Hosts at Escape Risk

Broadcom has patched a critical VMware Workstation and Fusion vulnerability that could create a VM escape path from a guest machine to its host.

The flaw, tracked as CVE-2026-59346, carries a CVSS score of 9.3. An attacker with local administrative privileges inside a virtual machine could exploit it to execute code on the host. Broadcom also patched CVE-2026-59347, a separate buffer overflow vulnerability with a CVSS score of 8.1.

Both vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1. Broadcom fixed them in 26H1u1 and provided no workarounds. Organizations running affected versions should therefore prioritize the VMware patch rather than rely on temporary mitigations.

How can CVE-2026-59346 lead to a VM escape?

CVE-2026-59346 is an integer overflow vulnerability affecting VMware Workstation and Fusion. Exploitation requires local administrative privileges within a guest VM that uses the VMXNET3 virtual network adapter.

A successful exploit can allow the attacker to execute code on the underlying host. This crosses an important virtualization security boundary. Organizations often rely on virtual machines to isolate development environments, testing workloads, untrusted software, or security research from the host operating system.

A successful VM escape can weaken that isolation. Once attackers reach the host, the potential exposure extends beyond data stored inside the original guest. Depending on the host configuration and user privileges, sensitive files, development credentials, browser sessions, SSH keys, source code, and access to internal resources could become targets.

The requirement for administrative privileges inside the VM reduces the number of direct exploitation paths. However, organizations should not treat that prerequisite as sufficient protection. Attackers who already control a guest environment could use the vulnerability as another stage in a broader compromise.

Featured Resource

Cybersecurity kit

Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.

Download the Resource Kit

What is CVE-2026-59347?

Broadcom also addressed CVE-2026-59347, an HGFS stack-based buffer overflow vulnerability. HGFS supports file-sharing functionality between VMware guests and hosts.

An attacker with local administrative privileges inside a VM may exploit the flaw to execute code as the virtual machine’s VMX process on the host. Broadcom assigned the vulnerability a CVSS score of 8.1 and classified it as Important.

Broadcom received both vulnerabilities through private disclosures. As of its September 3 advisory, the company had not identified a workaround. SecurityWeek also reported that Broadcom had not mentioned evidence of active exploitation in the wild.

What should enterprises do about the VMware patch?

Organizations should first identify host endpoints running VMware Workstation or Fusion 25H2 or 26H1. Administrators should then upgrade affected installations to 26H1u1.

The VMware patch must be applied to the host endpoint running Workstation or Fusion. Updating only the guest operating system does not remediate a vulnerability in the host-side VMware virtualization software.

Teams should give additional attention to developer workstations, security testing systems, administrator endpoints, and research devices. These systems may run multiple virtual machines while also holding privileged credentials or access to sensitive internal environments.

Organizations should also review which VMs use VMXNET3 and limit administrative access inside guest systems. Virtual machines downloaded from untrusted sources should receive the same scrutiny as other potentially hostile code.

Endpoint security monitoring should continue after patching. Security teams should investigate unexpected process execution, suspicious file activity, credential access attempts, privilege escalation, and unusual network behavior on systems that previously ran vulnerable versions.

How can Hexnode support VM escape risk management?

Hexnode UEM’s native application inventory gives administrators visibility into applications installed on managed endpoints, including application version information. Administrators can also use Scan for Apps to refresh application inventory data and identify endpoints that still report vulnerable VMware versions. Custom scripts provide a secondary option when teams need to collect additional information and store script output in device custom attributes.

After identifying affected hosts, administrators can add the VMware 26H1u1 installer to Hexnode as an Enterprise App and distribute it to targeted devices. Hexnode’s Required Apps policy can enforce deployment across selected Windows or macOS hosts, depending on the VMware product and supported installer package. Administrators can also use the Install Application action for targeted deployments.

For supported Windows and macOS endpoints, Hexnode XDR adds endpoint threat visibility after deployment. Its agent monitors process execution, file activity, network behavior, and system changes. Hexnode XDR maps threat activity to MITRE ATT&CK tactics such as Privilege Escalation, Credential Access, and Lateral Movement. When analysts confirm malicious activity, they can isolate an endpoint, kill malicious processes, or quarantine files.

Patch the host before a VM escape becomes possible

CVE-2026-59346 shows why virtual machines should not make organizations complacent about host security. A guest environment can become an attack path when a vulnerability breaks the expected isolation boundary.

Enterprises should deploy VMware 26H1u1, review affected endpoints, restrict unnecessary guest privileges, and monitor previously vulnerable systems for suspicious activity. With no workaround available, timely patching remains the primary remediation for both vulnerabilities.