7.8 HighCWE-367
CVE-2026-41702
TOCTOU local privilege escalation vulnerability
VMwareFusion
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.2%probability of exploitation in the next 30 days
Higher than 5% of scored CVEs
SeverityCVSS
7.8High
Description NVD
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 14 May · 09:11 UTC | SecurityWeek | Broadcom patches Fusion flaw CVE-2026-41702 stops root access |
| Thu 14 May · 16:20 UTC | Security Affairs | Broadcom releases VMware Fusion security update for root access bug |
| Mon 18 May · 12:12 UTC | The Hacker News | Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws |
- Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation FlawsThe Hacker News · mentions it in passing
- Broadcom releases VMware Fusion security update for root access bugSecurity Affairs
- Broadcom patches Fusion flaw CVE-2026-41702 stops root accessSecurityWeek · first in our coverage