VMware Security Advisory

Broadcom published VMSA-2026-0006 (29 July 2026) detailing multiple critical vulnerabilities in VMware products—notably CVE-2026-59309 (vCenter Directory Service authentication bypass, CVSS 9.8), CVE-2026-59310 (vCenter Syslog directory traversal leading to possible remote code execution, CVSS 9.8), and CVE-2026-47876 (VMXNET3 out-of-bounds write allowing code execution from a VM on ESX, CVSS 9.3). The advisory affects ESX, vCenter, Workstation, Fusion, VMware Cloud Foundation, vSphere Foundation, and Telco Cloud platforms and recommends applying the posted patches and using ESX Live Patch or vCenter Quick Patch where applicable.