Vulnerability intelligence
CVE-2026-41702
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
CVSS Score
7.8
High
EPSS — Exploit Probability
0.1%
Riskier than 2% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
3 articles across 3 outlets · first covered May 14, 2026 · latest May 18, 2026
Coverage timeline
-
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flawsthehackernews.com · May 18, 2026
-
Broadcom releases VMware Fusion security update for root access bugsecurityaffairs.com · May 14, 2026
-
Broadcom patches Fusion flaw CVE-2026-41702 stops root accesswww.securityweek.com · May 14, 2026