CVE-2026-59346

CriticalCVSS 9.3

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

Risk Assessment

An attacker with admin privileges in a VM can escape the VM and execute code on the host, potentially leading to full host compromise.

Recommendation

Upgrade VMware Workstation and Fusion to version 26H1u1 or later. Restrict administrative privileges in VMs and monitor activity.

Other vulnerabilities in VMware Workstation and Fusion

CVE-2026-59347High
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: Workstation 25H2, 26H1 (fixed in 26H1u1); Fusion 25H2, 26H1 (fixed in 26H1u1).

Original NVD description (English source)

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS