Broadcom Patches Three Critical VMware Bugs, Including a vCenter Login Bypass
One flaw lets an attacker skip the login screen on vCenter entirely. Two more allow code execution and virtual machine escape across ESX, Workstation and Fusion.
Key points
- Broadcom shipped fixes for multiple VMware security flaws affecting ESX, vCenter, Workstation and Fusion, with three rated critical.
- The worst bug, CVE-2026-59309, carries a CVSS score of 9.8 and lets an attacker on the network bypass vCenter authentication.
- The other two critical bugs enable remote code execution and a guest-to-host escape from inside a virtual machine.
- Administrators should patch immediately; vCenter servers reachable from untrusted networks are the priority.
- No public exploitation has been reported at time of writing.
Broadcom has released security updates for its VMware product line, and three of the flaws are serious enough that any administrator running these products should stop reading and start patching.
VMware, for readers outside IT, is the software most large companies use to run many separate computers (called virtual machines) on a single physical server. vCenter is the master console that manages all of them. ESX is the underlying software that hosts them. Workstation and Fusion are the desktop versions.
The headline bug is CVE-2026-59309, an authentication bypass in vCenter with a CVSS score of 9.8 out of 10. In plain terms: an attacker who can reach the vCenter server over the network can get in without a valid password. Once inside vCenter, they effectively control every virtual machine that server manages.
The two other critical flaws, first reported by The Hacker News, cover remote code execution (running attacker-chosen commands on the machine) and a virtual machine escape (breaking out of a guest VM to attack the host underneath). VM escape is the scenario that keeps cloud engineers awake, because it breaks the wall that is supposed to separate one customer's workload from another's on shared hardware.
What products are affected?
ESX, vCenter, Workstation and Fusion all receive fixes in this round. Broadcom's advisory is the authoritative list of patched build numbers, and admins should match their installed version against it before assuming they are covered.
| Flaw | Product | Impact | Severity |
|---|---|---|---|
| CVE-2026-59309 | vCenter | Authentication bypass | Critical (9.8) |
| Second critical | ESX / Workstation / Fusion | Remote code execution | Critical |
| Third critical | ESX / Workstation / Fusion | VM escape | Critical |
(Broadcom's disclosure names the reporting researchers in the advisory itself; check there for attribution before crediting anyone publicly.)
How bad is this in practice?
Bad, if your vCenter is exposed. A 9.8-rated auth bypass on a management console is close to a worst-case rating, because vCenter typically holds credentials, snapshots and network access to every VM it runs. An attacker who reaches it can deploy ransomware (software that locks files until a payment is made) across an entire estate in minutes.
The code execution and VM escape bugs are lower-probability but higher-blast-radius: they matter most to hosting providers, managed service firms and any organisation running multi-tenant workloads on shared ESX hosts.
Should ordinary customers do anything?
Not directly. These are enterprise infrastructure bugs, not consumer software. If you use an online service whose provider runs on VMware (which is a lot of them), the practical answer is that your provider is responsible for patching. You will not see a prompt on your phone.
That said, if you run Workstation or Fusion on a personal laptop for development or testing, update through the built-in updater or from Broadcom's download portal.
What should admins do this week?
Patch vCenter first, then ESX hosts, then desktop products. If patching vCenter immediately is not possible, restrict network access to the management interface so only admin jump hosts can reach it. Exposing vCenter to the wider corporate network (let alone the internet) was already a bad idea; with CVE-2026-59309 public, it is now a resume-generating event.
