Published on 31 July 2026
Anyone using VMware to virtualise their servers should not tolerate any delay this week. On 29 July 2026, Broadcom released security updates for VMware vCenter, ESXi, Workstation and Fusion, closing three critical vulnerabilities in the process. Two of them can be exploited from the network without any authentication whatsoever, potentially giving attackers full control over the entire virtualised infrastructure – meaning all servers running on the platform, along with the data stored on them. Broadcom explicitly classifies the updates as an "Emergency Change", thereby demanding immediate action.
The good news first: at the time of publication there is no confirmed exploitation of these flaws "in the wild" and no publicly known attack code. The bad news: experience shows that this window closes quickly. VMware vCenter has already appeared ten times on the list of actively exploited vulnerabilities (KEV list) maintained by the US agency CISA. Attackers know exactly how valuable these systems are.
With the security advisory VMSA-2026-0006, Broadcom addressed a total of five vulnerabilities. Three of them are rated critical:
Additionally, two less severe flaws were closed: CVE-2026-41703 (CVSS 7.6, information disclosure/DoS) and CVE-2026-41709 (CVSS 2.7, insufficient logging). The CVSS score ranges from 0 to 10 – anything from 9.0 upwards is considered critical.
The VMware Directory Service (vmdir for short) is a directory service responsible for login and permissions management in vSphere environments – comparable to a digital doorman. The flaw allows an attacker with network access to vCenter to completely bypass this doorman and gain administrative access without valid credentials. In Broadcom's words:
„A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.“ (Broadcom, VMSA-2026-0006)
Neither authentication nor user interaction is required – the attack runs purely over the network.
The syslog server collects log data. The vulnerability is a directory traversal (also called path traversal): here the attacker tricks the application into addressing file paths outside the intended directory. As a result, an unauthenticated attacker with network access can execute arbitrary code on the vCenter server – effectively taking over the system.
VMXNET3 is a performance-optimised virtual network adapter used in VMware environments for higher throughput. The flaw lies in the ESXi-side implementation: an attacker who already holds local administrator rights inside a VM with a VMXNET3 adapter can provoke a faulty memory access (out-of-bounds write) and thereby execute code directly on the ESXi host. Broadcom puts it this way:
„An attacker who already holds local administrative privileges inside a virtual machine that uses the VMXNET3 virtual network adapter may execute code on the ESX host.“ (Broadcom, VMSA-2026-0006)
With this, the attack breaks the central security guarantee of virtualisation: the separation between guest VM and hypervisor. Whoever controls the host controls all VMs running on it. Only VMs with a VMXNET3 adapter are affected – other adapter types such as e1000 are not affected by this specific flaw, but Broadcom explicitly does not recommend switching as a workaround.
The two vCenter flaws were discovered by Phil Brass and Matt South of Atredis Partners, the VM escape by Nguyen Hoang Thach of STARLabs SG as part of the Pwn2Own competition. There are no workarounds for any of the five vulnerabilities – patching is the only remedy.
Affected are VMware vCenter Server, VMware ESXi, VMware Workstation and VMware Fusion in various versions. Specifically, vCenter 8.0 prior to version 8.0 U3k as well as vSphere Foundation 9.0.x/9.1.x are considered vulnerable; several ESXi versions are affected. vSphere 7.0 is also considered affected – however, this version has reached end of support and requires either an upgrade or an extended support contract.
For small and medium-sized enterprises in Germany, the risk is particularly relevant where VMware products are used as a virtualisation platform for web servers, databases or business applications. To put the prevalence into context: according to 6sense (2026), VMware holds around 42% market share among virtualisation platforms with roughly 130,000 enterprise customers worldwide. Particularly alarming: the BSI/CERT-Bund warned in January 2026 that around 2,500 VMware ESXi management interfaces in Germany were openly accessible from the internet – 60% of them running versions no longer supported.
„CERT-Bund is currently aware of around 2,500 VMware ESXi server management interfaces in Germany that are openly accessible from the internet. These should generally not be exposed to the internet. [...] 60 percent of the servers are running outdated versions that no longer receive support from the manufacturer.“ (BSI/CERT-Bund, January 2026)
Patches have been available since 29 July 2026 and are cumulative – they do not require prior patches. The download is via support.broadcom.com. Important: according to Broadcom policy (KB 314603), critical patches are also available to customers with expired support contracts.
Please note: ESXi updates require a host reboot; vCenter updates briefly interrupt access to the vSphere Client, but running VMs are not affected by this.
The Rapid7 team emphasises the particular severity of the two vCenter flaws:
„Both vulnerabilities are particularly significant because exploitation does not require prior authentication. [...] Customers running affected VMWare products are urged to patch on an urgent basis before exploitation in-the-wild occurs.“ (Rapid7 Threat Intelligence Team, 30 July 2026)
Why this matters so much is summed up by BleepingComputer: whoever compromises vCenter or ESXi often gains access to large parts of a company's servers and data. Many ransomware groups – including Akira, Play, TargetCompany and Qilin – have developed dedicated encryption tools for VMware. In 2024, the average ransom demand in attacks on ESXi servers was 5 million US dollars.
The SOCPrime team warns specifically about the VM escape:
„This VM Escape Vulnerability is particularly serious in multi-tenant, cloud, and enterprise virtualization environments. Compromise of the hypervisor can expose other virtual machines, management data, application workloads, and infrastructure secrets located on the same host.“ (SOCPrime Team, 30 July 2026)
The fact that earlier vCenter flaws (such as CVE-2021-22005 and CVE-2023-34048) were quickly picked up by attackers is historically documented. Field Effect reminds us that the exploitation of such flaws has been linked to unauthorised access, web shell deployment and ransomware. You should therefore use the currently open window without a known exploit as a head start – not as a reason to wait.
Anyone using VMware and processing personal data – for example on web servers, in databases or CRM systems – must also consider the data protection dimension. Successful exploitation of CVE-2026-59309 or CVE-2026-59310 would give attackers full access to the vCenter management level and thereby to all managed VMs. CVE-2026-47876 allows an attacker who already controls a VM to take over the entire host. Both can constitute a breach of the protection of personal data within the meaning of Art. 4 No. 12 GDPR.
In such a case, Art. 33 GDPR applies: controllers must report a data breach to the competent supervisory authority (in Germany, the respective state data protection commissioner) without undue delay, if possible within 72 hours, insofar as there is a risk to the rights and freedoms of natural persons. In the case of high risk, the data subjects must also be informed under Art. 34 GDPR.
Decisive is Art. 32 GDPR: it requires appropriate technical and organisational measures – and these include the timely application of security patches. If a known critical flaw is not patched, this can be assessed as a violation. A precedent: in 2022, the British data protection authority ICO imposed a fine equivalent to 5 million euros against Interserve Group Ltd., because after a ransomware attack, outdated software and missing patches contributed to the compromise of 113,000 records.
Three critical vulnerabilities, two of them exploitable from the network without authentication, no workarounds – the situation is clear-cut. Broadcom has already responded and provided patches that are also accessible to customers with expired support contracts. No attack code is public yet, but with vCenter flaws experience shows this changes quickly.
If you use VMware products, the next steps are clear: check versions, apply patches, seal off management interfaces from the open internet, and prioritise VMXNET3 systems. In doing so, you not only minimise the immediate security risk of an operational outage or data loss, but also your liability under the GDPR. Do not let the short window you now have pass by.