# Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876) Allow Auth Bypass, RCE, and VM Escape

> Broadcom's VMSA-2026-0006 patches an unauthenticated authentication bypass in the vCenter VMware Directory Service (CVE-2026-59309, CVSS 9.8), a directory-traversal flaw in the vCenter Syslog server enabling arbitrary code execution (CVE-2026-59310, CVSS 9.8), and an out-of-bounds write in the VMXNET3 virtual network adapter allowing guest-to-host VM escape (CVE-2026-47876, CVSS 9.3). Broadcom states no evidence of in-the-wild exploitation or public PoC for any of the three.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-08-14T00:44:03.281Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1764
- **ID:** TL-2026-1764
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 56 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709

## Description

On 2026-07-29 Broadcom published VMSA-2026-0006, a security advisory covering five vulnerabilities across the VMware virtualization portfolio (vCenter Server, ESX/ESXi, Cloud Foundation, vSphere Foundation, Workstation, Fusion, Telco Cloud Platform, and Telco Cloud Infrastructure). Three of the five are rated CRITICAL and are the focus of this threat record.

CVE-2026-59309 (CVSS 9.8) is an authentication bypass in the VMware Directory Service (vmdird) that underpins vCenter Single Sign-On. A network-based attacker with no prior credentials can send crafted requests to the Directory Service and fully bypass authentication, gaining unauthorized administrative access to the vCenter management plane — and, transitively, to every ESXi host, VM, and workload vCenter governs. Broadcom credits Phil Brass and Matt South of Atredis Partners for the discovery.

CVE-2026-59310 (CVSS 9.8) is a directory-traversal vulnerability in the vCenter Syslog server. A network-based, unauthenticated attacker can traverse the filesystem to read or write files outside the intended logging directory, which escalates to arbitrary code execution on the vCenter appliance (a Linux/Photon-OS-based virtual appliance). Security reporting describes a compromised vCenter as a potential "beachhead for lateral movement" into the rest of the virtual infrastructure.

CVE-2026-47876 (CVSS 9.3) is an out-of-bounds write in the VMXNET3 paravirtualized network adapter used by ESX/ESXi guest VMs. An attacker who has already obtained local administrator privileges inside a guest VM configured with a VMXNET3 adapter can trigger the OOB write to execute code on the underlying ESX host — a classic guest-to-host VM escape. VMs using other adapter types (e.g., E1000/E1000E) are not affected by this specific flaw.

Broadcom's advisory also lists two lower-severity companion issues in the same disclosure batch — CVE-2026-41703 (CVSS 7.6, out-of-bounds read / information disclosure or DoS in ESX, Workstation, and Fusion) and CVE-2026-41709 (CVSS 2.7, insufficient logging in ESX) — which are noted here for advisory-cluster context but are not part of this threat's tracked CVE set.

No workaround exists for either critical vCenter issue (CVE-2026-59309, CVE-2026-59310); patching to the fixed builds is the only remediation Broadcom documents. No workaround is documented for CVE-2026-47876 either. Broadcom states it has no information indicating any of the three critical CVEs have been exploited in the wild, and no public proof-of-concept exploit code has surfaced as of this writing; the vulnerabilities were privately reported by external researchers and credited in the advisory (Phil Brass and Matt South of Atredis Partners; Nguyen Hoang Thach of STARLabs SG, associated with Pwn2Own; Maxim Suhanov; and Ian Barton of CrowdStrike).

Given the severity (two unauthenticated, network-exploitable 9.8s on the vCenter management plane, plus a 9.3 hypervisor-escape bug), unpatched vCenter/ESXi environments represent an attractive target: successful chaining of CVE-2026-59309 → CVE-2026-59310 would give a remote, unauthenticated attacker full code execution on the vCenter appliance without ever needing valid credentials, and CVE-2026-47876 gives any VM-level attacker with local admin a path out of the guest sandbox onto the physical host.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1685.006 Clear Linux or Mac System Logs
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1005 Data from Local System
- T1588.006 Vulnerabilities
- T1499.001 OS Exhaustion Flood
- T1587 Develop Capabilities
- T1556 Modify Authentication Process
- T1518 Software Discovery
- T1136 Create Account
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1499.004 Application or System Exploitation
- T1212 Exploitation for Credential Access
- T1580 Cloud Infrastructure Discovery
- T1588.002 Obtain Capabilities: Tool
- T1053.003 Scheduled Task/Job: Cron
- T1027 Obfuscated Files or Information
- T1027.002 Obfuscated Files or Information: Software Packing
- T1105 Ingress Tool Transfer
- T1219 Remote Access Software
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape](https://thehackernews.com/2026/07/three-critical-vmware-flaws-allow-auth.html)
- [vcf-security-and-compliance-guidelines: security-advisories/vmsa-2026-0006](https://github.com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006)
- [VMSA-2026-0006 Support Content Notification](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)
- [Critical VM Escape Vulnerability Patched in VMware ESXi](https://www.securityweek.com/critical-vm-escape-vulnerability-patched-in-vmware-esxi/)
- [Broadcom Patches CVE-2026-59309 & CVE-2026-59310 (CVSS 9.8) in VMware](https://securityonline.info/vmware-authentication-bypass-cve-2026-59309/)
- [Critical VMware Flaws Allow Attackers to Bypass Authentication and Gain Access to the System](https://cybersecuritynews.com/vmware-flaws-allow-authentication-bypass/)
- [Critical VMware vCenter Flaws Let Remote Attackers Bypass Authentication and Execute Code](https://gbhackers.com/critical-vmware-vcenter-flaws/)
- [Broadcom Patches Critical VMware ESXi Vulnerability Enabling Host Code Execution](https://securityaffairs.com/196231/security/broadcom-patches-critical-vmware-esxi-vulnerability-enabling-host-code-execution.html)
- [VMware Telco Cloud response to VMSA-2026-0006](https://knowledge.broadcom.com/external/article/449886/vmware-telco-cloud-response-to-vmsa20260.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1764