Broadcom Patches Three Critical VMware Bugs, Including a vCenter Login Bypass
One flaw lets an attacker skip the login screen on vCenter entirely. Two more allow code execution and virtual machine escape across ESX, Workstation and Fusion.
Key points
- Broadcom shipped fixes for VMware security flaws affecting ESX, vCenter, Workstation and Fusion, with three rated critical.
- The worst bug, CVE-2026-59309, carries a CVSS score of 9.8 and lets an attacker on the network bypass vCenter authentication without a valid password.
- The other two critical bugs enable remote code execution and a guest-to-host escape from inside a virtual machine.
- Administrators should patch immediately; vCenter servers reachable from untrusted networks are the priority.
- No public exploitation has been reported at time of writing.
Broadcom has released security updates for its VMware product line, and three of the flaws are serious enough that any administrator running these products should stop reading and start patching.
VMware is the software most large companies use to run many separate computers (called virtual machines) on a single physical server. VCenter is the master console that manages all of them. ESX is the underlying host software. Workstation and Fusion are the desktop versions.
The headline bug is CVE-2026-59309, an authentication bypass in vCenter with a CVSS score of 9.8 out of 10. An attacker who can reach the vCenter server over the network gets in without a password. Once inside, they effectively control every virtual machine that server manages.
The two other critical flaws cover remote code execution (running attacker-chosen commands on the machine) and a virtual machine escape (breaking out of a guest VM to attack the host underneath). VM escape is the scenario that keeps cloud engineers awake, because it breaks the wall that separates one customer's workload from another's on shared hardware. We covered a similar host-escape flaw in VMware ESXi on 29 July 2026, so this is a pattern worth watching.
What products are affected?
ESX, vCenter, Workstation and Fusion all receive fixes in this round. Broadcom's advisory is the authoritative list of patched build numbers; admins should match their installed version against it before assuming they're covered.
| Flaw | Product | Impact | Severity |
|---|---|---|---|
| CVE-2026-59309 | vCenter | Authentication bypass | Critical (9.8) |
| Second critical | ESX / Workstation / Fusion | Remote code execution | Critical |
| Third critical | ESX / Workstation / Fusion | VM escape | Critical |
(Broadcom's disclosure names the reporting researchers in the advisory itself; check there for attribution before crediting anyone publicly.)
How bad is this in practice?
Bad, if your vCenter is exposed. A 9.8-rated auth bypass on a management console is close to a worst-case rating, because vCenter typically holds credentials and network access to every VM it runs. An attacker who reaches it can deploy ransomware (software that locks files until a payment is made) across an entire estate in minutes.
The code execution and VM escape bugs are lower-probability but higher-blast-radius: they matter most to hosting providers and managed service firms running multi-tenant workloads on shared ESX hosts.
Should ordinary customers do anything?
Not directly. These are enterprise infrastructure bugs, not consumer software. If you use an online service whose provider runs on VMware, your provider is responsible for patching. You won't see a prompt on your phone.
If you run Workstation or Fusion on a personal laptop for development or testing, update through the built-in updater or from Broadcom's download portal.
What should admins do this week?
Patch vCenter first, then ESX hosts, then desktop products. If patching vCenter immediately isn't possible, restrict network access to the management interface so only admin jump hosts can reach it. Exposing vCenter to the wider corporate network was already a bad idea; with CVE-2026-59309 now public, it's a resume-generating event.
The honest read here: a 9.8 authentication bypass on the console that controls your entire virtual estate is about as bad as it gets on paper, but the real test is how many vCenter instances are sitting exposed right now. History says: more than anyone will admit.
