On July 29, 2026, Broadcom published security advisory VMSA-2026-0006, documenting vulnerabilities spanning across multiple structural layers of the vSphere ecosystem, divided primarily between centralised management daemons running on vCenter Server and kernel-level device emulation drivers executing within the ESXi hypervisor.
The flaw stems from improper identity assertion processing within the VMware Directory Service daemon (vmdir). An unauthenticated threat actor with network access to the vmdir interface can send crafted network traffic to bypass standard authentication checks entirely and establish an administrative session.
Once connected, the attacker gains complete control over the vCenter management plane and can manipulate global administrative configurations, modify virtual machine states, extract sensitive memory snapshots, or compromise attached ESXi hypervisors.
Located within the vCenter Syslog logging daemon, this directory traversal flaw allows an unauthenticated remote attacker to submit log messages containing path traversal sequences directly to the Syslog service port. By escaping the designated syslog logging directory, the attacker executes arbitrary code with root-level local privileges directly on the underlying vCenter Server Virtual Appliance (vCSA) operating system. This provides a primary entry point for deeper lateral movement across the internal network.
Manifesting as an out-of-bounds write condition within the hypervisor process handling VMXNET3 buffer allocations, this flaw allows an attacker who has already achieved local administrative control inside a guest virtual machine to write malicious payloads beyond allocated buffer boundaries. The attacker breaks out of the guest isolation container and executes arbitrary code directly within the host ESXi hypervisor kernel context. Virtual machines configured with alternative, non-VMXNET3 network adapters remain entirely unaffected by this flaw.
Caused by an out-of-bounds read error during VM creation or hardware parameter allocation, an authenticated user with VM deployment rights on ESX can trigger memory corruption by supplying specially crafted parameters during provisioning. On ESX hypervisors, this action triggers host process termination resulting in a Denial-of-Service or sensitive host memory disclosure. On desktop virtualisation software (VMware Workstation and Fusion), the operational impact is strictly confined to local information disclosure.
Arising from insufficient logging validation within specific ESXi administrative routines, this flaw allows a malicious or compromised administrator operating on the host to perform specific administrative operations directly on the ESXi host. Targeted operations execute silently without generating audit log records. This enables stealthy post-exploitation persistence and severely hinders post-incident forensic investigations.
In a top-down attack chain, an external or network-adjacent threat actor targets vCenter Server instances exposed to internal corporate networks or management segments. By deploying an exploit for CVE-2026-59309 against the vmdir service (TCP 389/636), the actor bypasses authentication to impersonate an administrative user. Alternatively, the adversary can exploit CVE-2026-59310 via the Syslog interface to drop web shells into persistent appliance directories, securing persistent root-level access to the management domain.
In a bottom-up attack chain, an adversary begins with administrative access inside a compromised guest VM (achieved via web app exploitation, stolen credentials, or insider activity). If the guest utilizes the standard VMXNET3 virtual network adapter, the attacker executes a host-escape exploit targeting CVE-2026-47876, breaking guest isolation to establish native code execution inside the ESXi hypervisor kernel. The attacker can then leverage CVE-2026-41709 to disable security monitoring and access co-located VMs without generating SIEM audit logs.
Because no vendor workarounds exist for the critical flaws, organisations must upgrade affected components to the specified build versions.
Advisory can be found here
