Vulnerability intelligence
CVE-2026-59347
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
CVSS Score
—
High
EPSS — Exploit Probability
0.2%
Riskier than 10% of all CVEs · checked 2026-10-18
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
4 articles across 4 outlets · first covered Sep 3, 2026 · latest Sep 5, 2026
Coverage timeline
-
Broadcom Patches Critical VMware Flaws Enabling VM-to-Host Code Executionthehackernews.com · Sep 5, 2026
-
VMware Fixes Critical Flaws Allowing Guest Code Execution on Hostssecurityaffairs.com · Sep 5, 2026
-
Broadcom Patches Critical VMware Flaws Enabling Host Code Executionwww.securityweek.com · Sep 4, 2026
-
CVE-2026-59346 (CVSS 9.3): VMware Flaw Allows Runnin Code on the Hostsecurityonline.info · Sep 3, 2026