Security AffairsPierluigi Paganini
Broadcom patches critical VMware flaws, including admin VM escape
Part of the CVE-2026-47876 story · since 29 Jul
- Wed 29 Jul, 11:51 UTC. SecurityWeek, first report. Broadcom Warns of VMware Flaws Allowing Host Code Execution.
- Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape. This article, 2nd of 2.
Broadcom has released critical patches for five vulnerabilities affecting VMware ESXi, vCenter, Workstation, and Fusion. The most severe, CVE-2026-47876, allows attackers with admin privileges in a VM to execute code on the ESXi host, rated with a CVSS score of 9.3. Other critical vulnerabilities include CVE-2026-59309, an authentication bypass in vCenter (9.8 CVSS), and CVE-2026-59310, allowing arbitrary code execution via a directory traversal vulnerability in vCenter (9.8 CVSS).
Broadcom also addressed CVE-2026-41703 and CVE-2026-41709, both with lower severities but still significant. Users are urged to apply the updates promptly.
How the story developed
2 articles from 2 outlets since 29 Jul. Quiet since 29 Jul. This was the 2nd report, 2 hours after the first.
- Wed 29 Jul, 11:51 UTC. SecurityWeek, first report. Broadcom Warns of VMware Flaws Allowing Host Code Execution.
- Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape. This article, 2nd of 2.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 2 articles as a listHide the list
- Wed 29 JulDay 02
- Broadcom Warns of VMware Flaws Allowing Host Code Execution11:51 · SecurityWeek · First report
- Broadcom patches critical VMware flaws, including admin VM escape14:07 · Security Affairs · This article, 2nd of 2