VulnSocial

CVE-2026-41703Patch

LOWCVSS 7.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 9 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 9 signals
  • Technical details provided in 6 signals
  • Peaked 4d ago at 3 mentions (2026-07-29); latest day: 1
  • 9 total mentions across 5 days

Deep dive

Activity timeline9 mentions / 5d
01223Mentions · 2026-07-29: 3Mentions · 2026-07-30: 2Mentions · 2026-07-31: 2Mentions · 2026-08-13: 1Mentions · 2026-08-14: 1Patch / Workaround · 2026-07-29: 3Patch / Workaround · 2026-07-30: 2Patch / Workaround · 2026-07-31: 2Patch / Workaround · 2026-08-13: 1Patch / Workaround · 2026-08-14: 1Technical Details · 2026-07-29: 2Technical Details · 2026-07-30: 1Technical Details · 2026-07-31: 1Technical Details · 2026-08-13: 1Technical Details · 2026-08-14: 107-2907-3007-3108-1308-14
Signal classification1 categories
Patch
9100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-293
Patch3
2026-07-302
Patch2
2026-07-312
Patch2
2026-08-131
Patch1
2026-08-141
Patch1
Full discourse9 posts
  • Zero Day Engineering@zerodayalpha
    Patch

    ⚡️ VMware just released a critical security update for ESXi hypervisor suite (VMSA-2026-0006). Two attack vectors: 1. Remote attack on vCenter – CVE-2026-59309: auth bypass via network access CVE-2026-59310: directory traversal RCE An exploit would allow control of entire ESXi infrastructure. 2. A VM-escapable set of two bugs – CVE-2026-59310: vmxnet3 OOBW CVE-2026-41703: core OOBR These are likely chainable to break out of VM and achieve code execution on hypervisor OS, as a privileged guest OS user. Diffing and exploiting (1) is straightforward and should be patched promptly.

    Post summary

    VMware announced a critical security update addressing several CVEs in ESXi, highlighting impact details and urging immediate patching, but no exploit code or confirmation of active exploitation is provided.

    452523410332.7K
    11.8K followersView on X
  • Dark Web Intelligence@DailyDarkWeb
    Patch

    🚨 Critical VMware vCenter Vulnerabilities — CVSS 9.8 Broadcom has issued VMSA-2026-0006.1 addressing multiple vulnerabilities across VMware vCenter, ESX, Workstation, Fusion and Cloud Foundation. * CVE-2026-59309 — Critical vCenter authentication bypass, CVSS 9.8. * An attacker with network access to vCenter may bypass authentication and gain unauthorized access. * CVE-2026-59310 — Critical vCenter directory traversal vulnerability, CVSS 9.8. * An attacker with network access may exploit it to execute arbitrary code on vCenter. * CVE-2026-47876 — Critical VMXNET3 out-of-bounds write, CVSS 9.3, potentially allowing a malicious VM administrator to execute code on the ESXi host. * Broadcom also patched CVE-2026-41703 and CVE-2026-41709. * Broadcom lists NO workaround for the critical vulnerabilities. Organizations should prioritize applying the available patches. 🔎 Analyst Note: vCenter represents a high-value management plane. Compromise can provide attackers with extensive visibility and control over virtualized infrastructure, making authentication bypass and remote code execution vulnerabilities particularly serious for enterprise environments. Source: Broadcom https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 #DDW #Cybersecurity #VMware #Vulnerability

    Post summary

    Broadcom released advisories on critical VMware vCenter vulnerabilities, detailing high CVSS scores and affected components, and urged patching, but no PoC or active exploitation claims were mentioned.

    1242853015.0K
    206.6K followersView on X
  • yousukezan@yousukezan
    Patch

    Broadcomは、VMware製品群に影響する複数の脆弱性を修正するセキュリティアドバイザリ「VMSA-2026-0006」を公開した。vCenterの認証回避やESXでのVMエスケープなど重大な問題が含まれ、CVSS最大値は9.8となっている。 最も深刻なCVE-2026-59309は、vCenter ServerのDirectory Serviceに存在する認証回避で、ネットワーク経由で管理プレーンへ不正アクセスできる可能性がある。CVE-2026-59310はSyslogサーバーのディレクトリトラバーサルにより任意コード実行が可能となる脆弱性で、いずれもCVSS 9.8。ESXでは、VMXNET3仮想ネットワークアダプターの境界外書き込み（CVE-2026-47876、CVSS 9.3）により、VM内のローカル管理者権限からESXホスト上でコードを実行し、VMエスケープにつながる可能性がある。このほか、境界外読み取り（CVE-2026-41703）や監査ログ不備（CVE-2026-41709）も修正された。 影響を受けるのはvCenter Server、ESX、Workstation、Fusion、Cloud Foundation、vSphere Foundation、Telco Cloud製品などで、BroadcomはvCenter 9.1.0.0300、9.0.2.0100、8.0 U3kや、ESXiおよびWorkstation、Fusion向けの修正版を公開している。 https://cybersecuritynews.com/vmware-flaws-allow-authentication-bypass/

    Post summary

    Broadcom released the VMSA‑2026‑0006 advisory detailing nine high‑severity CVEs (all with CVSS 9.8 or 9.3), and provided patches for all affected VMware products.

    01212372.6K
    15.0K followersView on X
  • Günter Born@etguenni
    Patch

    Teils kritische Schwachstellen (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709) in VMware by Broadcom-Produkten (VMware ESX, vCenter, Workstation, Fusion). Updates sind laut Adversory vorhanden. https://borncity.com/blog/2026/07/31/vmware-schwachstelle-u-a-in-esx-erlaubt-ausbruch-aus-vms/

    Post summary

    The post enumerates several newly disclosed VMware vulnerabilities and notes that vendor patches are available, but it provides no PoC, exploit code, or active attack reports.

    11020481
    2.9K followersView on X
  • Stanislav Klevtsov@stansecure
    Patch

    Top #CVE to #patch this week 👀 - @VMware #ESXi 9.0 RCE (CVE-2026-47876, CVE-2026-41703) - @JetBrains #TeamCity RCE (CVE-2026-63077, CVE-2026-65907) - #Jenkins Core (CVE-2026-70426) - @zohocorp ManageEngine ADAudit RCE (CVE-2026-6516) - @IBM Langflow RCE (CVE-2026-9198) - @ApacheKylin OS command injection (CVE-2026-62392) - #MOVEit auth bypass (CVE-2026-4670) - @giteaio unauth file read (CVE-2026-59774)

    Post summary

    The tweet lists a set of new CVEs across several products that require patching, providing the type of vulnerability for each, but no proof‑of‑concept, exploit, or evidence of active exploitation.

    1000073
    44 followersView on X
  • Autumn Good@autumn_good_35
    Patch

    VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

    Post summary

    The advisory announces VMware updates that patch multiple CVEs, without providing exploit details or evidence of active exploitation.

    00100827
    7.0K followersView on X
  • まこぴ@makopicut
    Patch

    VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

    Post summary

    Broadcom released a patch update for VMware ESX, vCenter, Workstation, and Fusion to fix multiple CVEs. The advisory URL contains further details.

    10000127
    117 followersView on X
  • TECHEPAGES@techepages
    Patch

    Broadcom just patched 5 vulnerabilities across VMware vCenter, ESX, Workstation, and Fusion — 3 of them critical, with no workarounds available and no exploitation observed in the wild (yet). Admins are urged to patch immediately: CVE-2026-59309 (9.8, Critical) — Auth bypass in VMware Directory Service; unauthenticated, network-only access to vCenter required. CVE-2026-59310 (9.8, Critical) — Directory traversal in vCenter Syslog server enabling unauthenticated RCE. CVE-2026-47876 (9.3, Critical) — VMXNET3 adapter flaw allowing VM-to-host escape. CVE-2026-41703 (7.6 ESX / 2.7 Workstation & Fusion) — Out-of-bounds read causing info disclosure or DoS. CVE-2026-41709 (2.7, Low) — Insufficient logging lets a malicious ESX admin act undetected.

    Post summary

    Broadcom released patches for five VMware vulnerabilities, all critical, and urges administrators to apply them immediately; no exploitation has been observed yet.

    0000079
    36 followersView on X
  • TECHEPAGES@techepages
    Patch

    🚨 5 VMware flaws just patched by Broadcom (ESXi, vCenter, Workstation, Fusion): 🔴 Critical: CVE-2026-47876 – VM escape via VMXNET3 adapter CVE-2026-59309 – vCenter auth bypass CVE-2026-59310 – vCenter RCE 🟠 High: CVE-2026-41703 – DoS/info leak 🟡 Low: CVE-2026-41709 – unlogged admin actions No exploitation in the wild yet — patch now. 🛡️

    Post summary

    Broadcom has released patches for five newly identified VMware vulnerabilities, including critical VM escape, auth bypass, and RCE flaws, and urges users to apply them immediately as no wild exploitation has been observed.

    0000073
    36 followersView on X

Explore more

Back to dashboard