Broadcom's VMSA-2026-0006 Patches Three Critical VMware Flaws — vCenter Has Failed This Exact Way Before
An auth bypass, a path-traversal RCE, and a VM-escape — none exploited yet, all with a KEV'd ancestor in the same bug class
Three Critical Bugs, One Broadcom Advisory
On July 29, 2026, Broadcom shipped VMSA-2026-0006, patching five vulnerabilities across VMware ESX, vCenter, Workstation and Fusion. Three are rated Critical and read like a greatest-hits list of virtualization attack surface: an authentication bypass in vCenter's Directory Service, a directory-traversal in vCenter's Syslog server that reaches code execution, and an out-of-bounds write in the VMXNET3 virtual NIC that lets a malicious VM admin break out to the host. None of the three has a public proof-of-concept and none is in CISA's Known Exploited Vulnerabilities catalog as of this writing — but as the precedent section below shows, vCenter and ESXi have been here before, more than once, in the exact same bug classes.
Scores as of 2026-08-06live record →
The Three Bugs, Explained
Two of the three run over the network with no authentication required at all; the third needs a foothold inside a virtual machine first. All three are rated Critical because of what they lead to, not how hard they are to reach.
| CVE | Component | CWE | CVSS 3.1 (vector) | What it does |
|---|---|---|---|---|
| CVE-2026-59309 | vCenter Directory Service | CWE-303 (Incorrect Auth Implementation) | 9.8 — AV:N/AC:L/PR:N/UI:N/S:U | Network-adjacent attacker bypasses login, gains unauthorized admin access |
| CVE-2026-59310 | vCenter Syslog Service | CWE-22 (Path Traversal) | 9.8 — AV:N/AC:L/PR:N/UI:N/S:U | Unauthenticated attacker reads/writes arbitrary files, reaches code execution |
| CVE-2026-47876 | ESXi VMXNET3 virtual NIC | CWE-787 (Out-of-Bounds Write) | 9.3 — AV:L/AC:L/PR:N/UI:N/S:C | VM admin triggers an OOB write, executes code on the host |
Different Attack Surface, Different Fix Package
Coverage of this advisory has cited one set of fixed build numbers — 9.1.0.0300, 9.0.2.0100 and 8.0 U3k — for all three bugs. Checking the CVE records directly shows that's only true for the two vCenter bugs. CVE-2026-47876 lives in ESXi itself, and ESXi ships its own build strings that don't match vCenter's. If you only patch vCenter, the ESXi VM-escape bug is still open on every host.
| Bug | Affected branch | Fixed build |
|---|---|---|
| CVE-2026-59309 / CVE-2026-59310 (vCenter) | 9.1.x.x | 9.1.0.0300 |
| 9.0.x.x | 9.0.2.0100 | |
| 8.0 | 8.0 U3k | |
| CVE-2026-47876 (ESXi) | 9.1.x.x | ESXi-9.1.0.0200-25557999 |
| 9.0.x.x | ESXi-9.0.2.0100-25595025 | |
| 8.0 | ESXi80U3k-25595708 |
vCenter Has Failed This Exact Way Before
Every bug class in VMSA-2026-0006 has a direct ancestor that was weaponized. CVE-2021-22005, a path-traversal-adjacent file-upload flaw in vCenter's Analytics service (same CWE-22 family as this year's Syslog bug), sits at 99.999th-percentile EPSS and is in CISA KEV. CVE-2023-34048, an out-of-bounds write in vCenter's DCERPC handling (same CWE-787 class as this year's VMXNET3 bug), is EPSS 99.4% and in KEV. CVE-2020-3952, a vmdir access-control failure adjacent to this year's authentication bypass, is EPSS 90.4% and in KEV. And CVE-2025-22224 — an ESXi guest-to-host escape from exactly one year ago, same CVSS 9.3 as this year's VMXNET3 bug — is in KEV despite an EPSS score of just 1.6%, proof that a low predicted-exploitation score hasn't kept VMware's hypervisor-escape bugs safe from real attackers.
| Label | Value |
|---|---|
| CVE-2026-59309 (2026, not KEV) | 0.74 |
| CVE-2020-3952 (2020, KEV) | 90.38 |
| CVE-2026-59310 (2026, not KEV) | 1.14 |
| CVE-2021-22005 (2021, KEV) | 99.999 |
| CVE-2026-47876 (2026, not KEV) | 0.28 |
| CVE-2025-22224 (2025, KEV) | 1.56 |
| CVE-2023-34048 (2023, KEV) | 99.43 |
| Precedent CVE | Bug class shared with 2026 | CWE | In KEV? | EPSS |
|---|---|---|---|---|
| CVE-2021-22005 (2021) | Path traversal / file write → RCE in vCenter (cf. CVE-2026-59310) | CWE-22 | Yes | 99.999% |
| CVE-2023-34048 (2023) | Out-of-bounds write → RCE in vCenter (cf. CVE-2026-47876 bug class) | CWE-787 | Yes | 99.43% |
| CVE-2020-3952 (2020) | Broken access control in vCenter's auth stack (cf. CVE-2026-59309) | CWE-306 | Yes | 90.38% |
| CVE-2025-22224 (2025) | Guest-to-host escape via OOB write in ESXi (cf. CVE-2026-47876) | CWE-367 | Yes | 1.56% |
Two paths, one blast radius
- Attacker reaches vCenter mgmt interface
- CVE-2026-59309: auth bypass
- CVE-2026-59310: path traversal → RCE
- vCenter admin access
- Push config/tasks to every managed ESXi host
- Attacker controls a guest VM (any route in)
- CVE-2026-47876: VMXNET3 OOB write
- Code execution on the ESXi host
- Access to every other guest on that host
Triage Before You Patch
- Inventory every vCenter Server Appliance and check its build number against the fixed thresholds above (VAMI or the appliance's build info).
- Patch vCenter first — CVE-2026-59309 and CVE-2026-59310 are unauthenticated and network-reachable; they're the higher-probability path to a compromise even though the ESXi bug has a more severe theoretical blast radius.
- Patch ESXi hosts for CVE-2026-47876 next, especially anything hosting VMs with less-trusted administrators or tenants — the whole value of the bug is breaking hypervisor isolation.
- Cloud Foundation, vSphere Foundation and Telco Cloud Platform/Infrastructure customers: patch through your bundle's own release train, not by hand-patching a vCenter or ESXi binary out of band.
What We Don't Know Yet
Broadcom's advisory is the only public reference for all three CVEs — there's no independent researcher writeup, no vendor blog post with technical depth, and no disclosed reporter credit in the CVE records we pulled. We also don't have a public PoC, a Metasploit or Nuclei module, or any KEV signal confirming real-world exploitation. Everything in this piece about attack chains and blast radius is inference from the CVSS vectors and CWE classes, not an observed incident — treat it as risk reasoning, not a confirmed campaign.
Data as of 2026-08-06