Tia N.List

Reported by 4 outlets

VMware Workstation VMXNET3 VM Escape Vulnerability (CVE-2026-59346)

new0.2
Why this score
Breadth
2.00 / 2.0 · 4 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
4.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.00 / 0.6 · time to second source
Recency
× 0.02 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.2 / 10 = base × recency + community
deafnews.itthreataft.comthecybersecguru.comsocprime.com CVE-2025-41236CVE-2026-59346 first seen 34d ago

Analysis

VMware Workstation VMXNET3 VM escape vulnerability CVE-2026-59346 (CVSS 9.3 per Broadcom, 7.5 per ZDI) is a CWE-190 integer overflow allowing guest-to-host escape. A public PoC was released by 0xCyberstan. The flaw affects VMware Workstation and requires patching to version 26H1u1. Because it enables a virtual machine to break out to the host, multi-tenant and development environments running affected versions are at elevated risk. Monitor for in-the-wild exploitation and confirm patch deployment across VM hosts.

Timeline

  1. original reporting

    VMware Workstation VMXNET3 flaw (CVE-2026-59346, CVSS 9.3) lets attackers escape guest VMs to execute code on the host. Patch to 26H1u1 now.

    deafnews.it · 34d ago · September 10th, 2026

    VMware Workstation VMXNET3 flaw (CVE-2026-59346, CVSS 9.3) lets attackers escape guest VMs to execute code on the host. Patch to 26H1u1 now.

    via Mastodon https://deafnews.it/en/article/vmware-workstation-vmxnet3-bug-with-cvss-93-breaks-hypervisor-isolation

  2. update from threataft.com

    🚨 CVE-2026-59346 — VMware VMXNET3 VM Escape CVSS 9.3 (Broadcom) / 7.5 (ZDI) | CWE-190 Integer Overflow Public PoC released by 0xCyberstan TS

    threataft.com · 5d ago · October 8th, 2026

    🚨 CVE-2026-59346 — VMware VMXNET3 VM Escape CVSS 9.3 (Broadcom) / 7.5 (ZDI) | CWE-190 Integer Overflow Public PoC released by 0xCyberstan TS

    via Mastodon https://threataft.com/articles/vmware-vmxnet3-cve-2026-59346-public-poc

  3. update from thecybersecguru.com

    🚨 Public PoC released for CVE-2026-59346, a critical VMware VMXNET3 integer overflow. The vulnerability affects the host-side `vmware-vmx` p

    thecybersecguru.com · 5d ago · October 8th, 2026

    The vulnerability affects the host-side vmware-vmx p

    via Mastodon https://thecybersecguru.com/exploits/cve-2026-59346-vmware-vmxnet3-poc/

  4. update from socprime.com

    CVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables Guest-to-Host Code Execution

    socprime.com · 4d ago · October 9th, 2026

    Broadcom has addressed CVE-2026-59346, a critical integer-overflow vulnerability affecting VMware Workstation and VMware Fusion. The flaw carries a CVSS score of 9.3 and can allow an attacker with administrative privileges inside a virtual machine to cross the virtualization boundary and execute code on the underlying host. The issue resides in VMware’s VMXNET3 virtual network adapter implementation. Successful exploitation could turn compromise of an isolated guest operating system into compromise of the system hosting that virtual machine, significantly increasing the potential impact in development, research, testing, and enterprise virtualization environments. The vulnerability affects the 25H2 and 26H1 branches of both products, and the vendor has not provided a workaround, making patching the primary remediation measure. Security teams can leverage SOC Prime’s AI-Native Detection Intelligence Platform to strengthen defenses against emerging vulnerability exploitation and accelerate detection engineering. Detection content can be applied across 40+ SIEM, EDR, and Data Lake technologies and enriched with relevant threat context. Uncoder AI can further help security professionals transform threat intelligence into detection logic, generate hunting queries, validate and refine rules, visualize attack flows, and translate detection content across multiple security platforms. Contact Sales CVE-2026

Source on GitHub