Virtual machines are supposed to be a containment boundary — a place to run untrusted code, test malware samples, or isolate risky workloads without putting the host machine at risk. Two newly patched vulnerabilities in VMware Workstation and Fusion undercut that assumption, giving an attacker who already controls a guest VM a path to executing code on the host itself.

Two Flaws, Two Different Paths Out of the Sandbox

Broadcom disclosed the pair of vulnerabilities in advisory VMSA-2026-0007, published September 3. The more severe of the two, CVE-2026-59346, carries a CVSS score of 9.3 and stems from an integer-overflow flaw in the VMXNET3 virtual network adapter — a component many VM configurations enable by default for better network performance. According to the advisory, successful exploitation lets an attacker “execute code on the host machine itself, effectively escaping the sandboxed VM environment.”

The second flaw, CVE-2026-59347, rated 8.1, is a stack-based buffer overflow in the Host-Guest File System (HGFS), the component responsible for handling file sharing between a guest VM and its host. Exploiting it allows an attacker to “execute code as the VMX process running on the host” — a slightly narrower outcome than the network-adapter bug, but still a serious breach of the isolation boundary virtualization is meant to provide.

Who Can Actually Exploit This

Both vulnerabilities require the attacker to already have local administrative privileges inside a guest virtual machine before they can attempt the escape. That’s a meaningful precondition, but it’s also a routine one in several common scenarios: security researchers deliberately running malware samples inside a VM for analysis, developers testing untrusted code, or any environment where a guest OS could plausibly be compromised through its own separate vulnerabilities before pivoting into the host.

In other words, the bar isn’t “no attacker access required” — it’s “the isolation an organization is relying on for safety turns out to have a hole in it once an attacker clears a first, fairly ordinary hurdle.”

Affected Products

The advisory covers VMware Workstation versions 25H2 and 26H1 across all supported host operating systems, along with VMware Fusion versions 25H2 and 26H1 on macOS. Both products are widely used by developers, security researchers, and IT teams for local virtualization, meaning the exposure spans far beyond enterprise data centers into everyday workstations.

No Workarounds — Patching Is the Only Option

Broadcom’s advisory is explicit that “there are no workarounds available for either vulnerability.” The company addressed both flaws in version 26H1u1, which is the only mitigation currently offered. Organizations and individuals running affected versions on older release branches without a direct upgrade path should treat migrating to a patched build as the immediate priority, since there’s no configuration change or mitigating control that meaningfully reduces the risk in the meantime.

Credit Where It’s Due

The network-adapter flaw, CVE-2026-59346, was reported independently by researcher h4urek of secsys lab and by the duo Y² and Stan S working through Trend Micro’s Zero Day Initiative — a pattern that sometimes signals a bug attracting attention from multiple corners of the research community around the same time. The HGFS buffer overflow, CVE-2026-59347, was credited to Yeonghyeon Choi and Tianchu Chen of Tencent’s Xuanwu Lab.

Why This Matters Beyond the Patch Notes

VM escape vulnerabilities strike at the core value proposition of virtualization: the promise that whatever happens inside a guest stays inside the guest. For security teams that rely on VMware Workstation or Fusion specifically for malware analysis or sandboxed testing, an unpatched host isn’t just exposed to routine risk — it’s exposed to the exact class of attacker that VM-based isolation was supposed to defend against in the first place.

Recommended Actions

• Upgrade all affected VMware Workstation and Fusion installations to version 26H1u1 without delay.
• Prioritize hosts used for malware analysis, untrusted code execution, or any workload where a compromised guest is a realistic scenario.
• Where immediate patching isn’t feasible, consider temporarily disabling the VMXNET3 adapter in favor of an alternative virtual network adapter as a partial risk reduction, while recognizing this does not address the HGFS-related flaw.
• Review host systems that ran suspicious or untrusted guest workloads recently for signs of unexpected host-level process activity.