1-minute read
What a defender needs to know
Broadcom’s five-CVE VMware advisory puts two 9.8 flaws in network-reachable vCenter: CVE-2026-59309 bypasses authentication in the Directory Service, and CVE-2026-59310 allows code execution through traversal in the Syslog server. The advisory appeared July 29 and was updated August 19; Broadcom’s 9.1 patch catalog was updated October 29. A separate ESX VMXNET3 out-of-bounds write, CVE-2026-47876, lets an actor with VM administrator privileges execute code on the host when that adapter is in use. Other adapters are outside that specific flaw. Two additional fixes address an out-of-bounds read in ESX, Workstation and Fusion and insufficient logging of certain malicious ESX administrator operations.
Limit vCenter management access to approved administrative paths and match each installed vCenter build to Broadcom’s product row. Inventory ESXi host versions, VMXNET3 adapters and guest-admin access; upgrade affected hosts on the matching branch. The vCenter 8.0 U3k patch is ISO build 25600417, and ESXi 8.0 U3k is build 25595708; the advisory also lists 8.0 U2f express patches and other branch-specific fixes. Workstation and Fusion 25H2 move to 26H1 for the read flaw. Broadcom lists no workaround for these issues. Verify installed builds after patching and review independent access and change history if earlier compromise is suspected: the insufficient-logging flaw can hide certain ESX administrator operations from host logs.