Broadcom Issues Patch for Critical VMware Workstation and Fusion Vulnerability (CVE‑2026‑59346)

Broadcom has published emergency security updates for VMware Workstation and VMware Fusion after researchers uncovered a high‑severity flaw that could let a malicious virtual‑machine administrator run code on the underlying host operating system.

The defect, catalogued as CVE‑2026‑59346, carries a CVSS score of 9.3, placing it in the "critical" range. According to the advisory, the vulnerability can be triggered when a user with administrative rights inside a virtual machine exploits a specific sequence of API calls, ultimately causing the host to execute attacker‑controlled instructions.

VMware Workstation and Fusion are widely used desktop virtualization products that enable developers, testers, and IT professionals to run multiple isolated operating systems on a single physical machine. Because the host and guest environments share hardware resources, a breach that escapes the guest can jeopardize the entire workstation, potentially exposing confidential data, credentials, or corporate networks.

Broadcom, which completed its acquisition of VMware's enterprise‑software business in 2022, responded quickly by releasing patches for the affected versions of both products. The updates address the underlying memory‑handling error and tighten the validation of guest‑initiated requests. VMware recommends that all users apply the patches immediately, especially those who run untrusted or third‑party virtual machines.

Security experts note that while the vulnerability requires the attacker to have administrative access inside the VM, that scenario is not uncommon in development and testing environments where privileged accounts are frequently used. "A compromised developer workstation can become a launchpad for lateral movement across an organization," said a senior analyst at a cybersecurity firm, who chose to remain unnamed. The analyst added that the rapid patch rollout helps mitigate the risk but stresses the importance of layered defenses, such as network segmentation and strict VM access controls.

The disclosure, first reported by The Hacker News, underscores the ongoing challenge of securing virtualization platforms as they become more integral to cloud‑native workflows. Broadcom has pledged to monitor for related issues and to work with the security community on future hardening efforts. In the meantime, IT teams are urged to verify that the patches are installed, review VM privilege assignments, and consider additional safeguards like intrusion‑detection systems that can flag anomalous guest‑to‑host interactions.