Vulnerability intelligence
CVE-2026-59346
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
CVSS Score
—
Critical
EPSS — Exploit Probability
0.3%
Riskier than 16% of all CVEs · checked 2026-10-17
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
5 articles across 4 outlets · first covered Sep 3, 2026 · latest Oct 8, 2026
Coverage timeline
-
VMware Patches Critical VM Escape Flaw After Public PoC Releasesecurityonline.info · Oct 8, 2026
-
Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Executionthehackernews.com · Sep 5, 2026
-
VMware Fixes Critical Flaws Allowing Guest Code Execution on Hostssecurityaffairs.com · Sep 5, 2026
-
Broadcom Patches Critical VMware Flaws Enabling Host Code Executionwww.securityweek.com · Sep 4, 2026
-
CVE-2026-59346 (CVSS 9.3): VMware Flaw Allows Runnin Code on the Hostsecurityonline.info · Sep 3, 2026