VMware fixes three critical flaws allowing auth bypass, VM escapes

Broadcom (for VMware products) released emergency security updates addressing five vulnerabilities across vCenter, ESX/ESXi, Workstation, and Fusion—including three critical flaws (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876) that permit authentication bypass, arbitrary code execution, and a VM escape. The advisory lists affected versions and fixed builds, warns of patching impacts (service interruptions and reboots), provides upgrade constraints for VMware Cloud Foundation, notes no evidence of active exploitation so far, and urges immediate patching because of the high impact to enterprise virtualization infrastructure.