Never lose a customer to a missed message
An AI agent trained on your own business, replying in seconds, in any language, on every channel your customers already use.
Broadcom patched a critical VMware Workstation Fusion flaw on September 3, 2026. It fixed an integer-overflow bug tracked as CVE-2026-59346, carrying a CVSS severity score of 9.3 out of 10. The bug could let an attacker with elevated privileges inside a virtual machine run code on the host computer itself.
How the VMware Workstation Fusion Flaw Actually Works
Security researchers call this a VM-escape vulnerability. That means malicious code can break out of the isolated virtual machine it’s running in and execute on the underlying host operating system. According to SecurityWeek’s report on the advisory, the bug is an integer-overflow issue. A specially crafted input can cause a calculation to wrap around and corrupt memory. That corruption gives an attacker code execution rights. Broadcom’s advisory, published as VMSA-2026-0007, credits the discovery to researchers who reported it through coordinated disclosure. It was not found after active exploitation.
Who Needs to Patch, and How Urgently
The flaw affects VMware Workstation and Fusion versions 25H2 and 26H1. Those are the desktop virtualization products widely used by developers, IT administrators and security researchers to run guest operating systems on Mac and Windows machines. Broadcom’s fix arrived in version 26H1u1. The vulnerability requires an attacker to already have elevated privileges inside a guest VM, so it’s not remotely exploitable from the open internet on its own. That’s a modest comfort at best. Anyone who runs untrusted code, malware samples, or third-party software inside a VM often does so precisely because they assumed the host was safely isolated.
Why a 9.3 Severity Score Is Rare
CVSS reserves scores above 9.0 for flaws combining high-impact consequences with low exploit complexity. A VM-escape bug earns that rating for a simple reason. Virtualization’s entire security premise holds that whatever happens inside the VM stays inside the VM. That premise collapses completely once someone exploits the flaw. Security researchers who use VMs specifically to safely analyze malware, or test suspicious code, carry the most direct exposure here. That’s exactly the scenario the isolation boundary exists to protect against.
This Follows a Pattern of September Disclosures
The VMware patch arrived in the same week as other significant disclosures. Attackers started actively exploiting an unpatched Magento and Adobe Commerce zero-day on September 4, using it to backdoor online stores. Separately, attackers breached JetBrains’ Cadence product through an unpatched TeamCity vulnerability. Taken together, this run of disclosures reflects a busy patch cycle across enterprise software this month. It isn’t one vendor’s isolated problem — the same week saw Google patch its seventh emergency Chrome bug of the year, and Berlin’s city government confirm a ransomware breach that leaked 5.8 terabytes of files.
What Makes VM-Escape Bugs Different From Ordinary Malware Risk
Most software vulnerabilities threaten only the system they’re found on. A VM-escape flaw works differently, because it defeats a security boundary that other tools depend on. Sandboxed malware analysis, isolated test environments, and even some cloud hosting setups all lean on one assumption: a VM can’t reach its host. When that assumption fails, every control built on top of it needs a fresh check too, not just the VM software itself.
How This Compares to Past VMware Security Incidents
VMware products have faced serious vulnerabilities before, including several VM-escape bugs disclosed in prior years that prompted similar emergency patching cycles. What sets this one apart is the severity score. A 9.3 rating places CVE-2026-59346 among the more dangerous flaws Broadcom has disclosed for its desktop virtualization line specifically, as opposed to its enterprise server products, which see a higher volume of security research attention overall. Broadcom’s acquisition of VMware in 2023 also changed how these advisories get published, consolidating disclosures under the company’s broader security bulletin process rather than VMware’s older, standalone system.
What IT Teams Should Do Next
Broadcom’s guidance is straightforward. Teams should upgrade affected Workstation and Fusion installations to version 26H1u1 as soon as operationally possible. Prioritize machines that run untrusted or unverified code first. Organizations that rely on VM isolation as a security control for malware analysis or sandboxed testing should treat this patch as time-sensitive. It is not routine maintenance, given how directly the flaw undermines that isolation assumption. Security teams that maintain a patch-management dashboard should flag this advisory for cross-checking against every desktop image still running the older builds, not just servers. IT administrators managing shared lab machines, where multiple researchers rotate through the same physical hardware, face the highest practical exposure and should treat this update as a same-week priority rather than folding it into a routine monthly patch cycle.
Frequently Asked Questions
What is CVE-2026-59346?
It’s a critical integer-overflow vulnerability in VMware Workstation and Fusion that can let an attacker escape a virtual machine and run code on the host computer.
How severe is this VMware Workstation Fusion flaw?
It carries a CVSS score of 9.3 out of 10, reflecting both high potential impact and relatively low exploitation complexity once an attacker has elevated access inside a VM.
Which product versions does this flaw affect?
It affects VMware Workstation and Fusion versions 25H2 and 26H1. Broadcom’s fix arrives in version 26H1u1.
Is this exploitable remotely over the internet?
Not directly. An attacker needs elevated privileges inside a guest virtual machine first. That’s still a realistic scenario for anyone running untrusted code in a VM.
Did anyone exploit this flaw before the patch came out?
Available reporting indicates researchers disclosed it through a coordinated process, not after active exploitation. Even so, organizations should patch promptly.
Sources
- SecurityWeek — VMware Workstation and Fusion Updates Patch Critical Vulnerability. securityweek.com
- Security Affairs — Broadcom Patches Critical VMware Workstation and Fusion VM-Escape Vulnerabilities. securityaffairs.com
Verification your users actually receive.
Send one-time passcodes over WhatsApp with a single API call. Replio can generate, hash and verify the code for you.
