CVE-2026-47876Disclosure

MEDIUMCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 8 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Back to dashboard

4.3/ 10 priority

Sources & remediation

Other references

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

Weakness type (CWE)

CWE-787

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
38 mentions across 13 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 15 signals
Technical details provided in 22 signals
Disclosure: 15 classified signals
General: 9 classified signals
Peaked 11d ago at 8 mentions (2026-07-30); latest day: 1
38 total mentions across 13 days

Deep dive

Activity timeline38 mentions / 13d

Signal classification4 categories

Disclosure

1539.5%

Patch

1231.6%

General

923.7%

Active Exploitation

25.3%

Referenced assets19 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	7	Active Exploitation1Disclosure1Patch5
2026-07-30	8	Disclosure2General2Patch4
2026-07-31	5	Disclosure2General1Patch2
2026-08-04	1	Disclosure1
2026-08-05	1	Active Exploitation1
2026-08-13	1	Patch1
2026-08-14	3	Disclosure3
2026-08-18	1	General1
2026-09-29	1	Disclosure1
2026-10-07	1	General1
2026-10-08	7	Disclosure4General3
2026-10-13	1	General1
2026-10-22	1	Disclosure1

Full discourse20 posts

Dark Web Intelligence@DailyDarkWeb76d
Disclosure
🚨 Critical VMware vCenter Vulnerabilities — CVSS 9.8 Broadcom has issued VMSA-2026-0006.1 addressing multiple vulnerabilities across VMware vCenter, ESX, Workstation, Fusion and Cloud Foundation. * CVE-2026-59309 — Critical vCenter authentication bypass, CVSS 9.8. * An attacker with network access to vCenter may bypass authentication and gain unauthorized access. * CVE-2026-59310 — Critical vCenter directory traversal vulnerability, CVSS 9.8. * An attacker with network access may exploit it to execute arbitrary code on vCenter. * CVE-2026-47876 — Critical VMXNET3 out-of-bounds write, CVSS 9.3, potentially allowing a malicious VM administrator to execute code on the ESXi host. * Broadcom also patched CVE-2026-41703 and CVE-2026-41709. * Broadcom lists NO workaround for the critical vulnerabilities. Organizations should prioritize applying the available patches. 🔎 Analyst Note: vCenter represents a high-value management plane. Compromise can provide attackers with extensive visibility and control over virtualized infrastructure, making authentication bypass and remote code execution vulnerabilities particularly serious for enterprise environments. Source: Broadcom https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 #DDW #Cybersecurity #VMware #Vulnerability
Post summary
Broadcom disclosed critical VMware vCenter vulnerabilities (CVE‑2026‑59309, CVE‑2026‑59310, CVE‑2026‑47876) with high CVSS scores and issued a patch, urging organizations to apply it promptly.
1242853015.0K
206.6K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi90d
Disclosure
بخصوص ثغرات VMware + vCenter CVE-2026-59309 تتجاوز المصادقة في Directory Service وتمنح المهاجم وصولاً غير مصرح به. CVE-2026-59310 تستغل Directory Traversal في Syslog server لتشغيل كود. كلتاهما 9.8، ويكفي وصول المهاجم إلى vCenter عبر الشبكة. الثغرة الثالثة CVE-2026-47876 هي VM escape بدرجة 9.3 داخل VMXNET3.
Post summary
Arabic text announces three high‑severity VMware vCenter vulnerabilities (CVE‑2026‑59309: auth bypass; CVE‑2026‑59310: directory traversal for code execution; CVE‑2026‑47876: VM escape) with severity scores of 9.8, 9.8, and 9.3 respectively, noting that network access to vCenter is enough to exploit them.
07050245.9K
50.2K followersView on X
Ali Saleh@alisalehiman85d
Active Exploitation
هشدار امنیتی : دسترسی سرور Vmware Esxi و VCenter رو سریعا محدود به آی پی های خودتون کنید. آسیب‌پذیری های بحرانی با شناسه‌های CVE-2026-59309، CVE-2026-59310 و CVE-2026-47876 شناسایی شده‌اند. سرورها به طور گسترده در حال هک شدن و Encrypt شدن دیتا توسط باج افزار هستند.
Post summary
The alert warns of active exploitation of VMware ESXi and vCenter servers through CVE‑2026‑59309, CVE‑2026‑59310, and CVE‑2026‑47876, with widespread hacking and ransomware encryption, urging immediate IP restrictions.
12045213.6K
823 followersView on X
yousukezan@yousukezan92d
Patch
Broadcomは、VMware製品群に影響する複数の脆弱性を修正するセキュリティアドバイザリ「VMSA-2026-0006」を公開した。vCenterの認証回避やESXでのVMエスケープなど重大な問題が含まれ、CVSS最大値は9.8となっている。最も深刻なCVE-2026-59309は、vCenter ServerのDirectory Serviceに存在する認証回避で、ネットワーク経由で管理プレーンへ不正アクセスできる可能性がある。CVE-2026-59310はSyslogサーバーのディレクトリトラバーサルにより任意コード実行が可能となる脆弱性で、いずれもCVSS 9.8。ESXでは、VMXNET3仮想ネットワークアダプターの境界外書き込み（CVE-2026-47876、CVSS 9.3）により、VM内のローカル管理者権限からESXホスト上でコードを実行し、VMエスケープにつながる可能性がある。このほか、境界外読み取り（CVE-2026-41703）や監査ログ不備（CVE-2026-41709）も修正された。影響を受けるのはvCenter Server、ESX、Workstation、Fusion、Cloud Foundation、vSphere Foundation、Telco Cloud製品などで、BroadcomはvCenter 9.1.0.0300、9.0.2.0100、8.0 U3kや、ESXiおよびWorkstation、Fusion向けの修正版を公開している。 https://cybersecuritynews.com/vmware-flaws-allow-authentication-bypass/
Post summary
The advisory VMSA-2026-0006 highlights multiple high‑severity CVEs affecting VMware products, provides technical details, and lists available patches.
01212372.6K
15.0K followersView on X
IT-Connect.fr@ITConnect_fr91d
Patch
⚠️ Failles VMware ESX / vSphere Broadcom a patché plusieurs failles critiques dans ses solutions de virtualisation, notamment la CVE-2026-47876 de type VM Escape. Plus d'infos par ici : - https://www.it-connect.fr/vmware-3-failles-critiques-vcenter-esx-juillet-2026/ #vmware #infosec https://t.co/BuxO2O6kgN
Post summary
Broadcom has released patches for several critical VMware ESX/vSphere vulnerabilities, notably CVE-2026-47876, a VM Escape flaw, with additional details available in the referenced article.
01001891.9K
11.7K followersView on X
ふじた_🐱♨️💻雑用係@nfujita55a21d
Disclosure
@ktgohan CVE-2026-59346 は WorkStation, Fusion で、ESXだと CVE-2026-47876 ですね。どちらも vmxnet3 に対する、VMエスケープですが、報告者が違うので、影響が同じ形？の別の脆弱性ではないでしょうか。
Post summary
The text compares two CVEs, stating that both involve VM escape vulnerabilities affecting vmxnet3, while suggesting they may be distinct vulnerabilities with similar impacts. It provides no PoC, exploit, active exploitation report, or remediation information.
11001876.9K
4.1K followersView on X
GovCERT.CZ@GOVCERT_CZ90d
Patch
🚨 Upozorňujeme na kritické zranitelnosti v produktech VMware, CVE-2026-59309, CVE-2026-59310 a CVE-2026-47876. Zranitelnosti v VMware vCenter umožňují vzdálenému útočníkovi se síťovým přístupem obejít autentizaci a získat neoprávněný přístup k vCenter, případně zneužít directory traversal ke spuštění libovolného kódu na vCenter. Zranitelnost VMXNET3 Out-of-Bounds Write umožňuje útočníkovi s administrátorskými oprávněními ve virtuálním stroji používajícím adaptér VMXNET3 spustit kód na ESX hostiteli. Dopad zahrnuje kompromitaci ESX hostitele, neoprávněný přístup, vzdálené spuštění kódu, únik informací nebo odepření služby. Dotčené produkty zahrnují VMware ESX, VMware vCenter, VMware Workstation, VMware Fusion, VMware Cloud Foundation, VMware vSphere Foundation, VMware Telco Cloud Platform a VMware Telco Cloud Infrastructure. 📌Doporučujeme aktualizovat na nejnovější verzi.
Post summary
The post highlights critical VMware vulnerabilities (CVE‑2026‑59309, CVE‑2026‑59310, CVE‑2026‑47876) with authentication bypass and code‑execution capabilities and urges users to update to the latest version; it provides no PoC, exploit code, or evidence of active exploitation.
031921.0K
4.3K followersView on X
じふ@yuuturn520d
Disclosure
CVE-2026-59346は、ESXiは対象じゃないのかと調べたら、「VMXNET3 は製品名(デバイス仕様)であって、共通のコードベースではないから」と言われた。でも代わりに、ESXi 側の本命は CVE-2026-47876(VMSA-2026-0006、CVSS 9.3、VMXNET3 のゲスト→ホスト)だから注意すべしと。
Post summary
CVE-2026-59346はESXiを対象としないとの説明に続き、ESXi側で注意すべき脆弱性としてCVE-2026-47876を挙げています。CVSS 9.3とゲストからホストへの影響は示されていますが、PoC、実悪用、修正適用の情報はありません。
02152883
630 followersView on X
ふじた_🐱♨️💻雑用係@nfujita55a21d
Disclosure
@ktgohan CVE-2026-47876 (ESX) は https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 で > Broadcom would like to thank Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG working with the Pwn2Own held by Zero day initiative for reporting this issue to us.
Post summary
The post identifies an ESX CVE and points to a Broadcom advisory, noting that a researcher reported the issue through Pwn2Own. It provides no PoC, exploitation evidence, technical details, or remediation information in the text.
120411.8K
4.1K followersView on X
Oishi Akito@aki__042121d
Disclosure
CVE-2026-47876 VMXNET3アダプターを使用するVM 内のrootからESXホスト上でコードを実行できるとのこと 3ヶ月くらい前の脆弱性だけどIDCFがやられたのコレかな？
Post summary
The text describes the technical details of CVE-2026-47876 (code execution via VMXNET3 adapter) and speculates if it relates to a past IDCF incident, but does not confirm active exploitation or remediation steps.
001402.2K
36 followersView on X
Günter Born@etguenni90d
Disclosure
Teils kritische Schwachstellen (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709) in VMware by Broadcom-Produkten (VMware ESX, vCenter, Workstation, Fusion). Updates sind laut Adversory vorhanden. https://borncity.com/blog/2026/07/31/vmware-schwachstelle-u-a-in-esx-erlaubt-ausbruch-aus-vms/
Post summary
Several new VMware CVEs have been announced; vendor updates are available, but no exploit details or PoC were disclosed.
11020481
2.9K followersView on X
ktgohan@ktgohan21d
General
@gidodongas 番組の途中ですが、CVE-2026-47876 が…
Post summary
投稿はCVE-2026-47876に触れていますが、内容が途中で途切れており、脆弱性の詳細や対応策、悪用状況は確認できません。
01010436
14.6K followersView on X
taruo@taruo21d
General
CVE-2026-47876 vmゲストからのハイパーバイザーへの脱出という脆弱性もあるみたい。もはやマトリックスの世界よね
Post summary
The text mentions CVE-2026-47876 with a vague reference to a hypervisor-escape vulnerability but provides no proof-of-concept, exploit details, active exploitation claims, patch information, or technical specifics. It appears to be a social-media-style mention without substantive vulnerability intelligence.
00011229
478 followersView on X
AbcLinuxu.cz@abclinuxu89d
General
Kritické zranitelnosti v produktech VMware: CVE-2026-59309, CVE-2026-59310 a CVE-2026-47876 https://ift.tt/IYKqptd
Post summary
The message lists three critical VMware vulnerabilities (CVE‑2026‑59309, CVE‑2026‑59310, CVE‑2026‑47876) but does not provide details on exploitation, patches, or technical specifics.
00020147
2.2K followersView on X
ANC-AD / CSIRT-AD@anc_ad91d
Disclosure
Les 2 més crítiques: 🔴 CVE-2026-59309 i CVE-2026-59310 (vCenter): un atacant podria saltar-se l'autenticació i executar codi. 🔴 CVE-2026-47876 (ESX): permetria executar codi al host des d'una màquina virtual. Traducció: control potencial de tota la teva infraestructura.
Post summary
The text announces three critical VMware CVEs (vCenter and ESX) that enable authentication bypass and code execution, potentially compromising full infrastructure control.
1001098
415 followersView on X
Directoratul Național de Securitate Cibernetică@DNSC_RO91d
Patch
🚨 ALERTĂ - Vulnerabilități critice în VMware ➡️ Broadcom a publicat în cadrul buletinului VMSA-2026-0006 actualizări care remediază mai multe vulnerabilități din produsele VMware. ⚠️ CVE-2026-59309 ⚠️ CVE-2026-59310 ⚠️ CVE-2026-47876 👉 https://www.dnsc.ro/citeste/alerta-vulnerabilitati-critice-in-vmware #DNSC https://t.co/hBBuBRymd9
Post summary
Broadcom released an update bulletin (VMSA-2026-0006) that provides patches for several VMware vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876).
00020237
4.7K followersView on X
Israel@f1tym191d
Patch
Broadcom patches critical VMware flaws, including a VM escape in ESXi (CVE-2026-47876) and an auth bypass in vCenter (CVE-2026-59309). https://ift.tt/UhrYCDd
Post summary
Broadcom has released patches for two critical VMware CVEs: a VM escape in ESXi (CVE-2026-47876) and an authentication bypass in vCenter (CVE-2026-59309).
0001173
1.0K followersView on X
SAQER@SAQERPRESS6d
Disclosure
重大なVMware ESXi VMエスケープの欠陥によりホストコード実行が可能 CVE-2026-47876 https://nvd.nist.gov/vuln/detail/cve-2026-47876 昨夜のニュース、経路はこれの影響だと思うけどね。
Post summary
The text announces CVE-2026-47876, a VMware ESXi VM escape vulnerability enabling host code execution, with a link to NVD and a speculative connection to recent news, but provides no PoC, exploit tool, patch, or confirmed active exploitation details.
00010111
12.5K followersView on X
Stanislav Klevtsov@stansecure77d
Patch
Top #CVE to #patch this week 👀 - @VMware #ESXi 9.0 RCE (CVE-2026-47876, CVE-2026-41703) - @JetBrains #TeamCity RCE (CVE-2026-63077, CVE-2026-65907) - #Jenkins Core (CVE-2026-70426) - @zohocorp ManageEngine ADAudit RCE (CVE-2026-6516) - @IBM Langflow RCE (CVE-2026-9198) - @ApacheKylin OS command injection (CVE-2026-62392) - #MOVEit auth bypass (CVE-2026-4670) - @giteaio unauth file read (CVE-2026-59774)
Post summary
A tweet lists multiple CVEs—mostly RCE and command injection flaws—emphasizing the necessity of patching them this week, with no mention of active exploitation, PoC, or false-positive claims.
1000073
44 followersView on X
hi^^@collysucker91d
Disclosure
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 5 VMware vulnerabilities. One of them is CVE-2026-47876, which allows to escape a VM using the VM virtual network card VMXNET3 using a out-of-bounds write vulnerability. Needs local admin permissions on the VM. #infosec #vmware #esxi
Post summary
Broadcom’s advisory discloses CVE‑2026‑47876, an out‑of‑bounds write vulnerability on the VMXNET3 virtual network card that permits VM escape with local admin privileges, but provides no PoC, exploit, or patch information.
00010111
218 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-47876

Dark Web Intelligence[verified]@DailyDarkWebDisclosure

Broadcom disclosed critical VMware vCenter vulnerabilities (CVE‑2026‑59309, CVE‑2026‑59310, CVE‑2026‑47876) with high CVSS scores and issued a patch, urging organizations to apply it promptly.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

Arabic text announces three high‑severity VMware vCenter vulnerabilities (CVE‑2026‑59309: auth bypass; CVE‑2026‑59310: directory traversal for code execution; CVE‑2026‑47876: VM escape) with severity scores of 9.8, 9.8, and 9.3 respectively, noting that network access to vCenter is enough to exploit them.

Ali Saleh[verified]@alisalehimanActive Exploitation

The alert warns of active exploitation of VMware ESXi and vCenter servers through CVE‑2026‑59309, CVE‑2026‑59310, and CVE‑2026‑47876, with widespread hacking and ransomware encryption, urging immediate IP restrictions.

yousukezan[verified]@yousukezanPatch

The advisory VMSA-2026-0006 highlights multiple high‑severity CVEs affecting VMware products, provides technical details, and lists available patches.

ふじた_🐱♨️💻雑用係[verified]@nfujita55aDisclosure

The text compares two CVEs, stating that both involve VM escape vulnerabilities affecting vmxnet3, while suggesting they may be distinct vulnerabilities with similar impacts. It provides no PoC, exploit, active exploitation report, or remediation information.

GovCERT.CZ[verified]@GOVCERT_CZPatch

The post highlights critical VMware vulnerabilities (CVE‑2026‑59309, CVE‑2026‑59310, CVE‑2026‑47876) with authentication bypass and code‑execution capabilities and urges users to update to the latest version; it provides no PoC, exploit code, or evidence of active exploitation.

ふじた_🐱♨️💻雑用係[verified]@nfujita55aDisclosure

The post identifies an ESX CVE and points to a Broadcom advisory, noting that a researcher reported the issue through Pwn2Own. It provides no PoC, exploitation evidence, technical details, or remediation information in the text.

Oishi Akito[verified]@aki__0421Disclosure

The text describes the technical details of CVE-2026-47876 (code execution via VMXNET3 adapter) and speculates if it relates to a past IDCF incident, but does not confirm active exploitation or remediation steps.