VMSA-2026-0006: Multiple VMware ESX, vCenter, Workstation and Fusion Vulnerabilities
Socura threat alert analyzing Broadcom's VMSA-2026-0006 advisory covering five VMware vulnerabilities. CVE-2026-59309: authentication bypass in vCenter's VMware Directory Service (vmdir) via crafted network traffic, enabling unauthenticated administrative session takeover. CVE-2026-59310: directory traversal in the vCenter Syslog daemon allowing unauthenticated attackers to submit log messages with path traversal sequences, escaping the syslog directory to achieve root-level code execution on the vCSA. CVE-2026-47876: out-of-bounds write in VMXNET3 buffer allocation enabling guest-to-host VM escape from a compromised VM with local admin access; VMs using non-VMXNET3 adapters are unaffected. CVE-2026-41703: out-of-bounds read during VM creation causing host process termination (DoS) or memory disclosure on ESX, limited to information disclosure on Workstation/Fusion. CVE-2026-41709: insufficient logging allowing a malicious ESXi administrator to perform operations without audit records, enabling stealthy post-exploitation persistence. The source describes two attack chains: top-down (external attacker compromises vCenter via CVE-2026-59309 or CVE-2026-59310 to gain management-plane control) and bottom-up (attacker with guest VM admin access exploits CVE-2026-47876 for VM escape, then uses CVE-2026-41709 for audit log evasion). No workarounds exist; patching to fixed versions is required. The source does not claim active exploitation or public PoC availability.
Research notes
- Root causeCVE-2026-59310 is a directory traversal in the vCenter Syslog daemon allowing unauthenticated attackers to escape the syslog directory via path traversal sequences in log messages, achieving root-level code execution on the vCSA.
- Root causeCVE-2026-59309 is an improper identity assertion in vmdir allowing unauthenticated network attackers to bypass authentication and establish administrative sessions.
- Exploit chainThe source describes a top-down chain (CVE-2026-59309 or CVE-2026-59310 against vCenter for management-plane compromise) and a bottom-up chain (CVE-2026-47876 guest-to-host VM escape from a compromised VM, followed by CVE-2026-41709 audit log evasion).
- Technical detailCVE-2026-47876 is an out-of-bounds write in VMXNET3 buffer allocation enabling guest-to-host VM escape; VMs with non-VMXNET3 adapters are unaffected.