Broadcom released emergency patches for five VMware flaws, three of them critical, affecting ESXi, vCenter, Workstation, and Fusion. The most notable, CVE-2026-47876, is an out-of-bounds write in the ESXi VMXNET3 network adapter that lets an attacker with admin rights inside a guest virtual machine run code on the host, a VM escape. Two critical vCenter flaws follow: CVE-2026-59309 is an authentication bypass reachable over the network, and CVE-2026-59310, scored 9.8, allows code execution through a directory traversal. Broadcom warns the vCenter bypass could be chained with the escape or the code-execution flaw to seize the hypervisor without any guest foothold. No exploitation is reported yet.
A use-after-free flaw in Linux's KVM hypervisor, nicknamed Januscape and hidden in the code for about 16 years, lets a virtual machine attack the physical host it runs on. Tracked as CVE-2026-53359, it sits in the shadow memory code that KVM uses on both Intel and AMD systems when nested virtualization is enabled. From inside a guest with root, an attacker can corrupt host kernel memory: the public proof-of-concept crashes the entire host, taking down every other tenant on that machine, and the researcher says a private exploit can run code as root on the host. The fix reached mainline Linux in June, and distributions are shipping updated kernels now.
TrustStrike Labs