Affected Systems

VMware Workstation and VMware Fusion versions 25H2 and 26H1. Affects systems with VMXNET3 virtual network adapter (CVE-2026-59346) and HGFS enabled (CVE-2026-59347). Both vulnerabilities require local administrative privileges on the guest VM.

Exploitation Status

No evidence of active exploitation in the wild. No public PoC available at time of disclosure. Exploitation requires local admin access on guest VM, which could be obtained through separate compromise (phishing, weak configurations).

Business Impact

VM escape vulnerabilities allow attackers with guest VM admin rights to execute arbitrary code on the ESXi host or VMX process. This breaks the hypervisor isolation boundary—a critical security control. Organizations running VMware Workstation or Fusion in multi-tenant or untrusted guest environments face elevated risk. Historical VMware vulnerabilities have been actively exploited (e.g., CVE-2026-59309/59310 breached 361 IPs across 47 countries within days).

Urgency

🟠 Within 24 hours

Recommended Actions

  • Upgrade VMware Workstation to version 26H1u1 or later immediately—no workarounds available
  • Upgrade VMware Fusion to version 26H1u1 or later immediately—no workarounds available
  • Audit guest VM administrative access controls and enforce least privilege to reduce attack surface
  • Monitor VMX process behavior and host-level logs for unusual code execution or privilege escalation attempts
  • Prioritize patching for environments running untrusted or multi-tenant guest VMs with VMXNET3 adapters