VulnSocial

CVE-2026-59346Patch

HIGH

Exploitation observed; activity peaked at 21 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

Back to dashboard
6.3/ 10 priority

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Threat summary

  • Active exploitation appears in 3 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 66 mentions across 14 observed days

What's happening

  • Active exploitation reported across 3 signals
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 28 signals
  • Technical details provided in 31 signals
  • Disclosure: 10 classified signals
  • Peaked 1d ago at 21 mentions (2026-10-08); latest day: 2
  • 66 total mentions across 14 days

Deep dive

Activity timeline66 mentions / 14d
05111621Mentions · 2026-09-03: 9Mentions · 2026-09-04: 3Mentions · 2026-09-05: 9Mentions · 2026-09-06: 5Mentions · 2026-09-07: 2Mentions · 2026-09-08: 1Mentions · 2026-09-09: 4Mentions · 2026-09-10: 1Mentions · 2026-09-11: 2Mentions · 2026-09-23: 1Mentions · 2026-09-25: 1Mentions · 2026-10-07: 5Mentions · 2026-10-08: 21Mentions · 2026-10-09: 2PoC Mentioned / Linked · 2026-09-03: 1PoC Mentioned / Linked · 2026-09-09: 1Active Exploitation · 2026-09-05: 1Active Exploitation · 2026-09-06: 1Active Exploitation · 2026-09-07: 1Patch / Workaround · 2026-09-03: 6Patch / Workaround · 2026-09-04: 3Patch / Workaround · 2026-09-05: 7Patch / Workaround · 2026-09-06: 4Patch / Workaround · 2026-09-07: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-09: 3Patch / Workaround · 2026-09-10: 1Patch / Workaround · 2026-09-11: 1Patch / Workaround · 2026-09-23: 1Technical Details · 2026-09-03: 8Technical Details · 2026-09-04: 3Technical Details · 2026-09-05: 7Technical Details · 2026-09-06: 4Technical Details · 2026-09-07: 2Technical Details · 2026-09-09: 4Technical Details · 2026-09-10: 1Technical Details · 2026-09-11: 1Technical Details · 2026-09-23: 109-0309-0409-0509-0609-0709-0809-0909-1009-1109-2309-2510-0710-0810-09
Signal classification4 categories
Patch
2463.2%
Disclosure
1026.3%
Active Exploitation
37.9%
General
12.6%
Referenced assets67 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-039
Disclosure3Patch6
2026-09-043
Patch3
2026-09-059
Active Exploitation1Disclosure1General1Patch6
2026-09-065
Active Exploitation1Disclosure2Patch2
2026-09-072
Active Exploitation1Disclosure1
2026-09-081
Patch1
2026-09-094
Disclosure1Patch3
2026-09-101
Patch1
2026-09-112
Disclosure1Patch1
2026-09-231
Patch1
2026-09-251
Disclosure1
Full discourse20 posts
  • Cyber Security News@The_Cyber_News

    ‼️ PoC Released for Critical VMware VMXNET3 Flaw Enabling Guest-to-Host Code Execution Details: https://cybersecuritynews.com/vmware-vmxnet3-flaw-poc/ A public proof of concept is now available for CVE-2026-59346, a critical integer overflow flaw in VMware’s VMXNET3 virtual network adapter. The flaw can allow an attacker with administrative access inside a guest virtual machine to execute code on the host. However, the published PoC shows a host process crash, not a working code-execution exploit. Its advisory lists Workstation and Fusion versions 25H2 and 26H1 as affected. The vendor security advisory states that no workaround is available. The flaw sits in the TCP Segmentation Offload, or TSO, processing path within the host’s VMware-VMX process. TSO splits a large network packet into smaller segments. #cybersecuritynews

    025239497225114.6K
    76.2K followersView on X
  • The Hacker News@TheHackersNews
    Patch

    🛑 A critical VMware flaw can turn local VM admin access into host code execution. Broadcom fixed CVE-2026-59346 and an HGFS flaw in Workstation and Fusion 26H1u1. Both affect 25H2 and 26H1, with no workarounds or known exploitation. How the code execution paths work: https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html

    Post summary

    The post announces a critical VMware flaw that permits local VM administrators to execute code on the host, which has been patched by Broadcom. It affects specific Workstation and Fusion releases but has no known exploits or workarounds.

    494332310178.2K
    2.4M followersView on X
  • yousukezan@yousukezan

    VMwareの仮想ネットワークアダプターVMXNET3に、ゲストOSからホスト側でコードを実行できる整数オーバーフローの脆弱性が見つかった。CVE-2026-59346として追跡され、VMware WorkstationとFusionに影響する。技術解析と実証コードも公開された。 問題はTCP Segmentation Offload（TSO）パケットの処理にある。ホストがゲストから受け取った2つの値を乗算する際、32ビット整数がオーバーフローし、実際に必要なサイズより小さいバッファーが確保される。その後、ゲスト側が制御する大量のデータが書き込まれ、範囲外書き込みが発生する。研究者Stan Sによると、2025年のCVE-2025-41236に対する修正では、この乗算処理が検査対象になっていなかった。影響するのはWorkstationとFusionの25H2および26H1で、26H1u1で修正された。CVSSは9.3。公開された実証コードはクラッシュまでで、実際のホスト上でのコード実行や悪用は確認されていない。 https://securityonline.info/vmware-vmxnet3-vulnerability-cve-2026-59346/

    0502100359.1K
    16.5K followersView on X
  • إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi
    General

    ثغرة في VMware Workstation Fusion تقييمها 9.8 رقمها CVE-2026-59346 حدث في اقرب وقت ياصديقي https://www.tenable.com/cve/CVE-2026-59346 https://t.co/2Lm0f6D24K

    Post summary

    A brief message notes CVE‑2026‑59346 for VMware Workstation/Fusion, mentions its 9.8 CVSS score, and links to a Tenable advisory, but provides no deeper technical, exploit, or mitigation information.

    4111847214.1K
    50.2K followersView on X
  • ThreatWire@ThreatWire_
    Patch

    🚨 CRITICAL: CVE-2026-59346 (CVSS 9.3) is a critical VMware Workstation and Fusion vulnerability that can enable guest-to-host code execution. The flaw is an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges inside a guest VM can exploit it to execute code on the host. 🔴 Update immediately to VMware Workstation/Fusion 26H1u1 or later. No workaround is available. 🔗 http://support.broadcom.com/security-advisories/… #VMware #Workstation #CVE #VM #Virtualization #PrivilegeEscalation #CyberSecurity #Infosec

    Post summary

    The post announces a critical VMware Workstation/Fusion vulnerability (CVE‑2026‑59346) with an integer‑overflow flaw, providing a patch recommendation and noting no workaround.

    0240633711.0K
    1.7K followersView on X
  • Yamato@Red Hat/Learning Solution Architect@lab8010

    うーん、この元投稿を見るとVMXNET3って書いてあるから『VMware仮想化環境！vSphere！？』とか言う人居そうだけどもこのCVEはvSphereではなくてWindowsやMac向けの無償仮想化ソフトウェアであるVMware WorkstationやFusionに対するものですね なので一般的なサーバ仮想化環境向けの話では無いです https://nvd.nist.gov/vuln/detail/cve-2026-59346

    228363107.5K
    3.9K followersView on X
  • Rıdvan Yağlı@ridvanyagli

    CVE-2026-59346 için yayımlanan PoC, VMware Workstation/Fusion'daki VMXNET3 TSO yolundaki 32-bit integer overflow'u tetikleyerek host tarafındaki vmware-vmx sürecinde heap buffer overflow ve SIGSEGV ile çökme oluşturuyor. https://github.com/0xCyberstan/CVE-2026-59346-POC

    09037161.9K
    2.5K followersView on X
  • ThreatWire@ThreatWire_

    🚨 PoC RELEASED: CVE-2026-59346 — VMware Workstation/Fusion VMXNET3 integer overflow (CVSS 9.3). Root cause: an integer overflow in the VMXNET3 path. A malicious actor with local administrative privileges inside a guest that uses VMXNET3 may be able to execute code on the host. Broadcom fixed it in VMSA-2026-0007. ⚠️ Affected: VMware Workstation and Fusion 25H2 and 26H1. Fixed in 26H1u1. Not in CISA KEV. ⚠️ A public PoC from a ZDI-credited researcher exists; it demonstrates a host crash (SIGSEGV), not a complete host RCE. ThreatWire has not run it. 🔴 Update to Workstation/Fusion 26H1u1 immediately. There is no workaround. Full breakdown 👉 https://www.threatwire.tech/research/vmware-vmxnet3-guest-to-host-is-cve-2026-59346 #CyberSecurity #InfoSec #VMware #Virtualization

    210036112.1K
    1.9K followersView on X
  • ExploitGrid@exploitgrid

    Public PoC released for CVE-2026-59346, a critical VMware VMXNET3 integer overflow. CVSS 9.3 | ExploitGrid: 37.2 The flaw can enable guest-to-host code execution. The PoC currently demonstrates a host-side crash. #VMware #CyberSecurity https://t.co/d4puRPP1w5

    1402791.7K
    405 followersView on X
  • ふじた_🐱♨️💻雑用係@nfujita55a

    @ktgohan CVE-2026-59346 は WorkStation, Fusion で、ESXだと CVE-2026-47876 ですね。 どちらも vmxnet3 に対する、VMエスケープですが、報告者が違うので、影響が同じ形？の別の脆弱性ではないでしょうか。

    11001876.9K
    4.1K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Disclosure

    CVE-2026-59346, a critical VMware Workstation vulnerability, lets an attacker escape a guest VM and execute code on the host. Broadcom rates it 9.3 CVSS. #VMware #Workstation #Fusion #CVE202659346 #VMXNET3 #Broadcom #InfoSec #PatchNow https://securityonline.info/vmware-cve-2026-59346-code-execution-host/ https://t.co/1rHQ9Q4WKZ

    Post summary

    The text announces a critical VMware Workstation vulnerability enabling guest-to-host code execution, but provides no PoC, exploit, or patch details.

    050132940
    13.0K followersView on X
  • kokumօtօ@__kokumoto

    VMware Workstation/Fusionにおける重大(Critical)なVMエスケープ脆弱性CVE-2026-59346の技術詳細とPoC（攻撃の概念実証コード）が公開。VMXNET3における整数オーバーフロー。TCPセグメントオフロード(TSO)パケットの取扱における不備で、乗算時の32ビット整数桁溢れ。 https://securityonline.info/vmware-vmxnet3-vulnerability-cve-2026-59346/

    0101061.3K
    7.9K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 KRİTİK VMware açığı: CVE-2026-59346 ! VMware Workstation ve Fusion'da bulunan VMXNET3 sanal ağ adaptöründeki integer overflow açığı, VM içerisinde yerel yönetici yetkisine sahip bir saldırganın host üzerinde kod çalıştırmasına yol açabiliyor. CVSS: 9.3 (Critical) Guest -> Host Code Execution Workaround yok 26H1u1 veya üzeri sürüme güncelleyin! İnceleyin: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288

    Post summary

    The message announces CVE-2026-59346, a critical integer overflow allowing guest-to-host code execution, and directs users to patch to version 26H1u1 or later; no PoC or active exploitation is reported.

    03174891
    2.4K followersView on X
  • dbugs@ptdbugs

    A PoC/exploit has been discovered for vulnerability CVE-2026-59346 PT ID: PT-2026-85031 Read on dbugs: https://dbu.gs/vulnerability/PT-2026-85031 Vendor: VMware Products: • VMware Workstation • VMware Fusion Description: VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1) Link: https://github.com/0xCyberstan/CVE-2026-59346-POC

    00083648
    3.7K followersView on X
  • まっちゃだいふく@ripjyr
    Patch

    VMware WorkstationとFusionのVMnet3の脆弱性がやばそうなので、AIにまとめてもらった。 ーーー VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347) → https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288 https://t.co/PMyrMX47ph

    Post summary

    The advisory announces that VMware Workstation and Fusion receive updates fixing integer‑overflow and buffer‑overflow issues in VMnet3, referencing vendor patch documentation but not providing exploit details.

    01052978
    8.7K followersView on X
  • Total Cyber-Sec@totalcybersec
    Disclosure

    🚨 Dos fallas en #VMware pueden convertir una VM comprometida en una puerta hacia el host. CVE-2026-59346 y CVE-2026-59347 permiten escenarios de #VMEscape y ejecución de código. 🔗 https://minutodaseguranca.blog.br/vulnerabilidades-vmware-workstation-fusion-escape-vm/ 🧵 Hilo #CyberSecurity 👇

    Post summary

    The post announces two new VMware CVEs that allow VM escape and code execution, and provides a link to a blog for more details.

    13021251
    15.8K followersView on X
  • yousukezan@yousukezan
    Patch

    Broadcomは9月3日、VMware WorkstationとFusionに存在する2件の脆弱性を修正した。 CVE-2026-59346はVMXNET3仮想ネットワークアダプターの整数オーバーフローで、VMXNET3を使用するゲスト内のローカル管理者がホストでコード実行できる可能性がある。 もう1件のCVE-2026-59347はHGFSのスタックバッファオーバーフローで、ゲスト内の管理者権限からホスト上のVMXプロセス権限でコード実行につながる。 影響するのはVMware Workstation 25H2と26H1、およびmacOS向けVMware Fusion 25H2と26H1である。両脆弱性ともゲスト内の管理者権限が必要で、実際の悪用や公開PoCは確認されていない。 Broadcomによると回避策はなく、WorkstationとFusionを26H1u1へ更新する必要がある。 https://securityonline.info/vmware-cve-2026-59346-code-execution-host/

    Post summary

    The post reports Broadcom’s patching of VMware Workstation/Fusion for CVE‑2026‑59346 and CVE‑2026‑59347, detailing the vulnerability types and advising users to upgrade to 26H1u1, with no evidence of exploitation or PoC.

    000431.7K
    16.1K followersView on X
  • ふじた_🐱♨️💻雑用係@nfujita55a

    @ktgohan CVE-2026-59346 (WorkStation, Fusion) は https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288 で > Broadcom would like to thank h4urek(@h4urek) with secsys lab & Y² (@cameudis) and Stan S working with TrendAI Zero Day Initiative for independently reporting this issue to us.

    210211.8K
    4.1K followersView on X
  • Daily CyberSecurity@Daily_CyberSec

    A VMware VMXNET3 vulnerability, CVE-2026-59346 (CVSS 9.3), allows VM escape. Full details and PoC exploit code are now public. Patch to 26H1u1. #VMware #VMXNET3 #CVE202659346 #VMEscape #Virtualization #Broadcom #PoC #Vulnerability https://securityonline.info/vmware-vmxnet3-vulnerability-cve-2026-59346/

    01041557
    13.0K followersView on X
  • DC3 DCISE@DC3DCISE
    Patch

    🚨 #DCISEWarning: VMware Workstation & Fusion Flaws 🛠 🎯 Threat: CVE-2026-59346/59347 allow local VM admins to execute code on the host. 🛡 Action: Update VMware Workstation and Fusion to version 26H1u1 https://t.co/4gzmhhR0ha

    Post summary

    The tweet highlights VMware Workstation and Fusion flaws (CVE-2026-59346/59347) that enable local VM admins to execute code on the host and urges users to update to version 26H1u1.

    11020953
    743 followersView on X

Explore more

Back to dashboard