VulnSocial

CVE-2026-59347Patch

MEDIUM

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

Back to dashboard
4.3/ 10 priority

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 22 mentions across 10 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 15 signals
  • Technical details provided in 15 signals
  • Disclosure: 3 classified signals
  • Peaked 9d ago at 5 mentions (2026-09-03); latest day: 2
  • 22 total mentions across 10 days

Deep dive

Activity timeline22 mentions / 10d
01345Mentions · 2026-09-03: 5Mentions · 2026-09-04: 2Mentions · 2026-09-05: 4Mentions · 2026-09-06: 1Mentions · 2026-09-07: 1Mentions · 2026-09-08: 1Mentions · 2026-09-09: 2Mentions · 2026-09-11: 2Mentions · 2026-10-07: 2Mentions · 2026-10-08: 2Active Exploitation · 2026-09-07: 1Patch / Workaround · 2026-09-03: 3Patch / Workaround · 2026-09-04: 2Patch / Workaround · 2026-09-05: 4Patch / Workaround · 2026-09-06: 1Patch / Workaround · 2026-09-07: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-09: 2Patch / Workaround · 2026-09-11: 1Technical Details · 2026-09-03: 5Technical Details · 2026-09-04: 1Technical Details · 2026-09-05: 4Technical Details · 2026-09-06: 1Technical Details · 2026-09-09: 2Technical Details · 2026-09-11: 209-0309-0409-0509-0609-0709-0809-0909-1110-0710-08
Signal classification3 categories
Patch
1477.8%
Disclosure
316.7%
Active Exploitation
15.6%
Referenced assets40 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-035
Disclosure2Patch3
2026-09-042
Patch2
2026-09-054
Patch4
2026-09-061
Patch1
2026-09-071
Active Exploitation1
2026-09-081
Patch1
2026-09-092
Patch2
2026-09-112
Disclosure1Patch1
Full discourse20 posts
  • まっちゃだいふく@ripjyr
    Patch

    VMware WorkstationとFusionのVMnet3の脆弱性がやばそうなので、AIにまとめてもらった。 ーーー VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347) → https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288 https://t.co/PMyrMX47ph

    Post summary

    The advisory announces that VMware Workstation and Fusion updates fix integer‑overflow and buffer‑overflow vulnerabilities (CVE‑2026‑59346/59347).

    01052978
    8.7K followersView on X
  • Total Cyber-Sec@totalcybersec
    Disclosure

    🚨 Dos fallas en #VMware pueden convertir una VM comprometida en una puerta hacia el host. CVE-2026-59346 y CVE-2026-59347 permiten escenarios de #VMEscape y ejecución de código. 🔗 https://minutodaseguranca.blog.br/vulnerabilidades-vmware-workstation-fusion-escape-vm/ 🧵 Hilo #CyberSecurity 👇

    Post summary

    Two new VMware vulnerabilities, CVE‑2026‑59346 and CVE‑2026‑59347, enable virtual‑machine escape and code execution, turning a compromised VM into a potential gateway to the host.

    13021251
    15.8K followersView on X
  • Sami Laiho@samilaiho
    Patch

    VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347) URL: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288 Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.3

    Post summary

    The advisory announces VMware Workstation and Fusion updates that patch two critical integer‑overflow and buffer‑overflow vulnerabilities (CVE-2026‑59346, CVE-2026‑59347), with an official fix and high exploit maturity but no PoC or exploit code cited.

    01010820
    30.6K followersView on X
  • Machina Record@MachinaRecord
    Active Exploitation

    【リンク集：週末のセキュリティ関連ニュース/記事】 ＜脆弱性＞ ・Google、Chromeのゼロデイ脆弱性を修正　今年に入って6件目（CVE-2026-85046） https://www.securityweek.com/google-patches-6th-chrome-zero-day-of-2026/ ・PostgreSQLにおける12年来の脆弱性でデータベースやサーバーの乗っ取りが可能に（CVE-2026-6471） https://www.securityweek.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/ ・Sangoma Switchvoxの脆弱性が攻撃で悪用される（CVE-2026-9586） https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/ ・Citrix NetScalerの重大な認証バイパス脆弱性が攻撃で悪用される（CVE-2026-19490） https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/ ・PaperCutの欠陥が悪用される　欧米の教育機関から認証情報を盗み出す目的（CVE-2026-81578、CVE-2026-82078） https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html ・VMware Workstation／Fusionの重大な欠陥により、VM管理者がホスト上でコード実行可能に（CVE-2026-59346、CVE-2026-59347） https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html ・パッチ未適用のTeamCity経由でJetBrainsのCadenceが侵害被害に　AWSの認証情報が盗まれる（CVE-2026-63077） https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html ・パッチ未適用のMagentoとAdobe Commerceのゼロデイが悪用され、オンラインストアにバックドアを仕込まれる https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html ＜マルウェア・その他脅威＞ ・月額料金不要のストリーミング端末SuperBox、家庭用ネットワーク通じて不正トラフィックを送信する恐れ https://www.malwarebytes.com/blog/news/2026/09/free-streaming-boxes-may-be-routing-criminal-traffic-through-your-home ・侵害されたサイト5,400件超がブロックチェーン上に保存されたClickFixペイロードを配信 https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/ ・REVSTEALER関連モジュールが4件見つかる　WindowsアップデートやMicrosoft Defenderを無効化し、クリプトマイナーを実行 https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html ・インターネットに公開されたSSH通じ、認証なしでMikroTikルーターが乗っ取られる https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html ・新種のバックドア「Ted」が標的のHAProxyビルド内に潜伏し、Webトラフィックを傍受 https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html ＜データ侵害/サイバー犯罪＞ ・ShipMonkの侵害で、削除されたはずの米国人顧客6万7,000人分のデータも流出　Trezorが発表 https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html ・ベルリン市保有の情報が大量にリークされる　最も機微性の高い文書5.26TBが流出―その全貌 https://medium.com/@jankammerath/the-berlin-mega-leak-inside-the-massive-5-26-tb-leak-of-the-citys-most-sensitive-documents-ab133444d1ba ＜AI関連＞ ・CrowdStrike、NVIDIAと共同開発したサイバーセキュリティ向け最先端AIモデル群「SafeMind」を発表 https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-launches-frontier-models-cybersecurity-created ・OpenAIエージェント、5月にドイツの休眠サイトを不正使用　数か月後にはHugging Faceを侵害 https://www.theregister.com/ai-and-ml/2026/09/04/rogue-openai-agents-used-dead-german-web-site-to-communicate-in-may-months-before-hugging-face-incident/5294554 ＜サイバー戦/APT/国家型アクター/地政学関連＞ ・買い取った位置情報で米軍兵士の追跡が依然可能　議会は原因究明に努める https://www.theregister.com/public-sector/2026/09/06/us-troops-can-still-be-tracked-by-purchased-location-data-and-congress-wants-to-know-why/5294652 ＜逮捕/テイクダウン/制裁/違反/その他法執行関連＞ ・IDScan社、1億5,300万人分の運転免許証が流出したデータ侵害めぐり提訴される https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/ ・シアトル・タイムズとニューズデイ、OpenAIとマイクロソフトを提訴　他紙に続き https://techcrunch.com/2026/09/05/seattle-times-and-newsday-are-the-latest-publications-to-sue-openai-and-microsoft/ ＜リサーチ/攻撃手法/TTP＞ ・Tengu：Mirai型Linux／IoTボットネットの解析 https://app.reverser.space/p/duckie/tengu-reverse-engineering-a-mirai-style-linux-iot#0x1083d ・見えないUnicode文字使い、メールのフィルターを回避する大規模フィッシングキャンペーン https://cyberworldops.eu/en/million-dollar-phishing-campaign-uses-invisible-unicode-characters-to ＜その他＞ ・Exchange Onlineの障害でメールの送受信に遅れ　「Server busy」というエラー表示も https://www.bleepingcomputer.com/news/microsoft/exchange-online-outage-causes-email-delays-server-busy-errors/ ・G7、量子サイバー脅威への備えを急ぐよう組織に呼びかけ https://therecord.media/g7-urges-organizations-to-prepare-for-quantum-threats

    Post summary

    The article highlights multiple CVEs that are actively exploited in the wild, with some vendors issuing patches while others remain unpatched; it provides no PoC or detailed technical breakdown.

    100102.1K
    1.3K followersView on X
  • CERT-PY@CERTpy

    ⚠️ Vulnerabilidades en productos VMware ❗ CVE-2026-59347 ❗ CVE-2026-59346 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-vmware-8/ https://t.co/Rl3ZuRDuEX

    00001186
    6.7K followersView on X
  • CERT@certlv

    ‼️ Atklātas ievainojamības VMware programmatūrā CVE-2026-59346 (CVSSv3 9.3) un CVE-2026-59347 (CVSSv3 8.1), kas ļauj uzbrucējam veikt patvaļīgu koda izpildi uz iekārtas, kura uztur VMware virtuālo mašīnu. Aicinām nekavējoties uzstādīt atjauninājumus: https://cert.lv/lv/2026/10/ievainojamibas-vmware-programmatura https://t.co/okrNHNXamy

    00001638
    5.7K followersView on X
  • Lucas von Hartmann🇨🇭🇩🇪🇱🇮@ichbinlucasv
    Patch

    VMware guest → hostCVE-2026-59346 (CVSS 9.3) integer overflow in VMXNET3. Guest admin + that NIC = code on the host. CVE-2026-59347 (8.1) stack overflow in HGFS shared folders → code as the host VMX process.Privately reported (h4urek, cameudis, Stan S / ZDI). Broadcom VMSA-2026-0007. Affects Workstation/Fusion 25H2 and 26H1. Fix: 26H1u1. No workaround. Not listed as in-the-wild yet — this is the escape hatch before someone chains it.https://www.securityweek.com/vmware-workstation-and-fusion-updates-patch-critical-vulnerability/ https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288#CVE202659346 #VMware #Escape

    Post summary

    VMware Workstation and Fusion suffer from two critical CVEs (CVE‑2026‑59346 and CVE‑2026‑59347) that have been disclosed, patched (26H1u1), and currently lack evidence of active exploitation.

    00010192
    856 followersView on X
  • Offensive Lab@OffensiveLab
    Patch

    Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. "A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host," Broadcom said in an alert. The tech giant credited @h4urek, @cameudis, and Stan S for discovering the issue. Also patched by Broadcom is a stack-based buffer-overflow vulnerability in HGFS (CVE-2026-59347, CVSS score: 8.1), which can be exploited by a bad actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab have been acknowledged for reporting the flaw.

    Post summary

    Broadcom released patches for two critical VMware Workstation/Fusion vulnerabilities, including an integer-overflow and a stack-based buffer overflow that could allow local privileged attackers to execute arbitrary code on the host.

    01000114
    249 followersView on X
  • Total Cyber-Sec@totalcybersec
    Disclosure

    2/3 📂 CVE-2026-59347 (CVSS 8.1) afecta #HGFS, el sistema de archivos compartido entre guest y host. El riesgo es crítico en laboratorios de #Malware, desarrollo y testing, donde la VM funciona como barrera de aislamiento. #VMEscape

    Post summary

    The post announces CVE‑2026‑59347 with a CVSS score of 8.1 affecting the HGFS shared filesystem, highlighting its critical risk in malware labs, but provides no proof of exploitation or mitigation details.

    1000059
    15.8K followersView on X
  • Autumn Good@autumn_good_35
    Patch

    VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288

    Post summary

    VMware released updates for VMware Workstation and Fusion that fix integer‑overflow and buffer‑overflow vulnerabilities identified as CVE‑2026‑59346 and CVE‑2026‑59347.

    00010552
    7.1K followersView on X
  • Blackstorm Security@blackstormsecbr

    VMware VMXNET3 guest-to-host overflow is CVE-2026-59346 A public PoC demonstrates a host crash. Not in CISA KEV. CVE-2026-59347 is a separate HGFS issue in the same advisory. https://www.threatwire.tech/news/vmware-vmxnet3-guest-to-host-is-cve-2026-59346 #vmware #vulnerabilitity #infosec #cybersecurity #exploitation https://t.co/mNC6WZc6QV

    00000191
    2.4K followersView on X
  • VulniPulse@vulnipulse

    CVE advisory (HIGH): CVE-2026-59347 - vmware: VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability. https://vulnipulse.com/advisories/vmware-cve-2026-59347 #CVE #CyberSecurity #VMware #VMwareWorkstation

    0000056
    21 followersView on X
  • Havij@_havij
    Disclosure

    CVE-2026-59346 & CVE-2026-59347: Inside the Critical VMware Workstation and Fusion Flaws Link: https://bashoverflow.com/cve-2026-59346-cve-2026-59347-inside-the-critical-vmware-workstation-and-fusion-flaws-37cb338f6ac5 #vmware #vmwareworkstation #vmwarefusion #cve202659346 #cve202659347 https://t.co/n91jlQAYZC

    Post summary

    The tweet announces two critical VMware Workstation and Fusion vulnerabilities (CVE‑2026‑59346 and CVE‑2026‑59347) and links to an article for additional details.

    0000047
    27 followersView on X
  • iototsecnews@iototsecnews
    Patch

    VMware Workstation and Fusion の脆弱性 CVE-2026-59346／59347 が FIX：ホスト上での任意のコード実行 https://iototsecnews.jp/2026/09/03/critical-vmware-workstation-and-fusion-vulnerabilities-allow-attackers-to-execute-code-on-the-host/ デスクトップ仮想化製品の VMware Workstation と VMware Fusion には、境界を越えた制御権の奪取につながる欠陥が存在します。ゲスト環境での管理者権限から基盤側の端末操作へ至る問題／ホスト上での不審なプログラム実行／分離機能の突破といった影響が懸念されます。対応策は修正用版 26H1u1 への更新／回避策の非存在に伴う速やかなパッチ適用／VMXNET3 や共有設定の確認です。なお、本件に関連する脆弱性は CVE-2026-59346／CVE-2026-59347 です。安全な運用に向けた迅速なパッチ適用が強く求められます。 #CVE202659346 #CVE202659347 #Fusion #VMware #Vulnerability #Workstation

    Post summary

    VMware Workstation and Fusion vulnerabilities CVE-2026‑59346/47 allow attackers to execute arbitrary code on the host; a patch (26H1u1) has been released and users are urged to update immediately.

    00000120
    514 followersView on X
  • Cert-IX@Certix_com
    Patch

    🚨 A compromised virtual machine should remain isolated. Two VMware flaws can break that boundary. Broadcom has patched CVE-2026-59346 and CVE-2026-59347 in VMware Workstation and Fusion. Attackers with local administrative privileges inside a guest VM may exploit the flaws to execute code through the VMX process on the underlying host. The warning: ⚠️ CVE-2026-59346 is a critical VMXNET3 integer-overflow vulnerability rated CVSS 9.3. ⚠️ CVE-2026-59347 is an HGFS stack-based buffer overflow rated CVSS 8.1. ⚠️ Broadcom lists no workaround for either vulnerability. Security teams should: ✅ Upgrade affected Workstation and Fusion installations to 26H1u1. ✅ Inventory developer laptops and unmanaged virtualisation hosts. ✅ Restrict administrative access inside guest systems. ✅ Isolate untrusted workloads from sensitive host credentials and files. ✅ Monitor for unexpected VMX-process behaviour. Broadcom’s advisory does not state that these flaws are being actively exploited. 🚀 Join Cert‑IX Early Access: https://cert-ix.com/early-access 🔎 Read the complete analysis: https://blog.cert-ix.com/articles/critical-vmware-escape-vulnerabilities-patched-immediate-action-required-mto7wahg #CertIX #VMware #CVE202659346 #CVE202659347 #VMEscape #VirtualisationSecurity #VulnerabilityManagement #CyberExposureManagement #CTEM

    Post summary

    The post focuses on Broadcom’s patch for two VMware Workstation/Fusion vulnerabilities (VMXNET3 integer‑overflow and HGFS buffer overflow), noting the lack of a workaround and urging security teams to upgrade, inventory, isolate, and monitor, while confirming no active exploitation has been reported.

    0000081
    14 followersView on X
  • NCIIPC India@NCIIPC
    Patch

    #Broadcom has fixed #Critical security vulnerabilities in #VMware Workstation and Fusion. #CVE-2026-59346 #CVE-2026-59347 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288

    Post summary

    Broadcom has released a patch fixing two critical VMware vulnerabilities (CVE-2026-59346 and CVE-2026-59347). No exploit details or active exploitation claims are included.

    00000272
    8.5K followersView on X
  • Vistem Solutions@VistemSolutions
    Patch

    VMware Workstation and Fusion Updates Patch Critical Vulnerability Broadcom patched VMware Workstation and Fusion vulnerabilities CVE-2026-59346 and CVE-2026-59347, which could allow code execution on the host. If your team uses VMware Workstation or Fusion, prioritize these updates immediately. Critical vulnerabilities like these can create serious risk if left unpatched, especially in development, testing, and remote work environments. ✅ Apply the latest Broadcom patches ✅ Review affected systems ✅ Validate endpoint and access controls ✅ Monitor for unusual activity Staying secure starts with proactive patching and continuous visibility. Need help strengthening your cybersecurity posture? Vistem Solutions can help you reduce risk, improve compliance, and keep your business moving forward securely. 📩 sales@vistem.com #Cybersecurity #VMware #VulnerabilityManagement #PatchManagement #CVE #ITSecurity #CyberResilience #VistemSolutions #SecureInnovation #BusinessSecurity https://www.securityweek.com/vmware-workstation-and-fusion-updates-patch-critical-vulnerability/?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

    Post summary

    The post announces Broadcom’s patch for critical CVEs affecting VMware Workstation and Fusion, urging immediate update to mitigate host code‐execution risks.

    0000047
    89 followersView on X
  • Xavier Rivera@XavierRiveraX
    Patch

    Broadcom patched two VMware Workstation and Fusion vulnerabilities: CVE-2026-59346 (CVSS 9.3), an integer overflow in the VMXNET3 network adapter, and CVE-2026-59347 (CVSS 8.1), a buffer overflow in HGFS. Both let a local VM admin execute code on the host. No workaround exists; the fix ships in version 26H1u1.

    Post summary

    Broadcom has released patches for two VMware Workstation/Fusion vulnerabilities (CVE-2026-59346 and CVE-2026-59347). The flaws involve an integer overflow in VMXNET3 and a buffer overflow in HGFS, enabling local code execution on the host; no workaround exists, and the patch is available in version 26H1u1.

    0000092
    602 followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Major alert for VMware users: Workstation and Fusion versions 25H2 and 26H1 have two critical vulnerabilities (CVE-2026-59346 & CVE-2026-59347) that allow guest VMs with local admin access to execute code on the host. CVSS scores of 9.3 and 8.1. Broadcom has released fix 26H1u1—no workarounds exist. Systems still running 25H2/26H1 should upgrade now. #VMware #Cybersecurity #Vulnerabilities #HostCodeExecution #PatchNow #Virtualization https://thedailytechfeed.com/critical-vmware-workstation-fusion-zero-day-fixes-host-execution-flaws-patched/

    Post summary

    The alert announces two critical VMware vulnerabilities, provides CVSS scores, and emphasizes that a vendor patch (26H1u1) is available, urging immediate upgrades while noting no workarounds.

    0000083
    707 followersView on X
  • FactoryInternet@FactoryInternet
    Patch

    VMware Critical Security Advisory VMSA-2026-0007 - VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347) Please see the latest advisory: VMSA-2026-0007

    Post summary

    VMware issued advisory VMSA‑2026‑0007 to disclose integer‑overflow and buffer‑overflow bugs (CVE‑2026‑59346/47) in Workstation and Fusion, and released security updates to patch the issues.

    0000038
    251 followersView on X

Explore more

Back to dashboard