Broadcom's latest VMware Workstation and Fusion advisory closes a critical hole in the virtual network adapter that guest VMs use every day — here's what the evidence actually supports.

VMware Workstation and Fusion exist to keep a guest operating system contained. That containment is the entire point of running untrusted code, malware samples, or test builds inside a VM instead of on bare metal. On September 3, 2026, Broadcom published VMSA-2026-0007, an advisory describing two vulnerabilities that chip away at exactly that boundary.[1]

What happened

Broadcom's advisory covers two separate issues in VMware Workstation and Fusion. The more severe one, CVE-2026-59346, is an integer-overflow bug in the VMXNET3 virtual network adapter, rated 9.3 on the CVSS v3.1 scale.[1] The second, CVE-2026-59347, is a stack-based buffer overflow in HGFS — the Host-Guest File System component VMware uses for shared folders — rated 8.1.[1] Both were reported to Broadcom privately, and the company says nothing about either flaw being exploited before the patch shipped.[2]

That's worth sitting with for a second. This isn't a "hackers are already inside your VMs" story. It's a "here's a hole that got fixed before anyone (that we know of) walked through it" story. Those are different things, and conflating them does readers no favors.

What the vulnerability actually is

According to Broadcom's own wording, a malicious actor with local administrative privileges on a virtual machine configured with a VMXNET3 adapter may exploit this issue to execute code on the host.[1] The root cause is classified as an integer overflow — a calculation, likely related to a size or length value passed from the guest, that wraps around and produces a smaller number than intended.[1]

Broadcom hasn't published the internal code path, the vulnerable function, or a proof-of-concept, and none of that is reconstructed here. What's confirmed is the category of bug (integer overflow), the component (VMXNET3), the access level required (local administrative privileges inside the guest), and the outcome (code execution on the host).[1]

The second issue, CVE-2026-59347, sits in HGFS. Broadcom describes it as a stack-based buffer overflow that a local administrative actor inside a VM can use to execute code as the virtual machine's VMX process running on the host.[1] The VMX process is the host-side process that manages a running VM, so getting code execution there is still a boundary break, just through a narrower door than the network adapter path.

Affected versions and severity

Both vulnerabilities affect VMware Workstation versions 25H2 and 26H1 on any host operating system, and VMware Fusion versions 25H2 and 26H1 on macOS.[1] Broadcom's response matrix lists both flaws together because they land in the same fixed release.

Source: Broadcom VMSA-2026-0007 response matrix.[1]

Broadcom classifies CVE-2026-59346 at the maximum end of its Critical severity range, with a CVSSv3.1 base score of 9.3.[1] CVE-2026-59347 lands one notch lower at 8.1, in Broadcom's Important range.[1] Neither the advisory nor Broadcom's public statements break down the full CVSS vector string component by component beyond linking to the FIRST calculator, so treat the 9.3 and 8.1 figures as the maximum scores Broadcom itself assigned rather than numbers pulled from a third-party aggregator.

Exploitation status — what's confirmed and what isn't

Broadcom's advisory makes no mention of active exploitation for either CVE, and SecurityWeek's reporting confirms the company describes both as privately reported issues with no workaround.[2] That's a meaningfully different situation from a zero-day being used in active attacks, and this article isn't going to call it one.

Whether either CVE has since been added to CISA's Known Exploited Vulnerabilities catalog could not be independently confirmed during the research for this article. That status can change quickly, so check CISA's KEV catalog directly rather than relying on a single article's snapshot.

There's a broader pattern worth flagging, though. SecurityWeek notes that more than two dozen VMware vulnerabilities already sit in CISA's KEV list, and that VMware security defects are frequently targeted by threat actors once details become public.[2] That history is a reasonable justification for patching promptly — it's not evidence that these two specific CVEs are currently under attack.

Who should care

The realistic attack scenario here requires an attacker to already have local administrative privileges inside a guest VM. That sounds like a narrow bar, but it's exactly the bar that malware analysis labs, red teams running offensive tooling inside VMs, and anyone hosting VMs for third-party or less-trusted workloads clear routinely — often on purpose. If you run untrusted code inside a VM specifically because you expect it to misbehave, this advisory is aimed squarely at you.

Multi-tenant desktop virtualization setups, shared lab environments, and any Workstation or Fusion install where a guest OS is administered by someone other than the host owner deserve priority attention. A home user running a single trusted VM for testing is at comparatively low practical risk, though there's no reason to leave the fix unapplied once it's available.

Patch and mitigation

Broadcom lists no workaround for either CVE.[1] The only remediation is upgrading to VMware Workstation or Fusion 26H1u1. Downloads and release notes are linked directly from the advisory:

• VMware Workstation Pro downloads: Broadcom support portal
• VMware Fusion downloads: Broadcom support portal

Because there's no configuration change that mitigates either flaw, disabling VMXNET3 or HGFS isn't presented by Broadcom as an accepted stopgap — the advisory simply states "none" under workarounds for both issues.[1] The practical response is to inventory which Workstation and Fusion installs are still on 25H2 or 26H1 without the u1 update, prioritize the ones running less-trusted guest workloads, and schedule the upgrade.

Security takeaway

This is a fairly ordinary vulnerability disclosure handled the way you'd want one handled: found privately, reported to the vendor, fixed before public disclosure, and shipped with a clear fixed version and no ambiguity about what's affected. The 9.3 score reflects what a successful exploit could do — full compromise of host confidentiality, integrity, and availability from a guest that shouldn't have had that reach — not evidence that anyone has actually pulled it off outside a lab.

If there's a lesson beyond "patch it," it's the same one that keeps showing up in VMware advisories: the guest/host boundary is not something to treat as absolute, especially in environments built specifically to run things you don't trust. Layered defenses — network segmentation around VM hosts, monitoring host-side processes like VMX for anomalous behavior, and keeping virtualization software current — matter more for exactly the workloads where this bug is most relevant.

Sources & References

1. Broadcom. "VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)." Published September 3, 2026. support.broadcom.com
2. Arghire, Ionut. "VMware Workstation and Fusion Updates Patch Critical Vulnerability." SecurityWeek, September 4, 2026. securityweek.com

Disclaimer: This article reflects information available from the sources cited as of publication. Exploitation status, KEV listing, and related details can change; consult Broadcom's advisory and CISA's KEV catalog directly for the latest status.