VMware VMSA-2026-0006: vCenter Authentication Bypass / RCE and ESXi VM Escape

VMware VMSA-2026-0006: vCenter Authentication Bypass / RCE and ESXi VM Escape

1. Basic Information

• Article Title: Critical VM Escape Vulnerability Patched in VMware ESXi
• Publisher: SecurityWeek
• Publication Date: July 29, 2026
• Original Source: https://www.securityweek.com/critical-vm-escape-vulnerability-patched-in-vmware-esxi/
• Related Sources:
  • Broadcom VMSA-2026-0006: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
  • FAQ: https://github.com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2026-0006
• Related Entities: CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709, VMware vCenter, ESXi, VMXNET3
• Severity: Critical

2. Executive Summary

Two vulnerabilities that allow vCenter authentication bypass or code execution via network access, along with one vulnerability allowing a local administrator on a compromised VM to escape to the ESXi host via VMXNET3, have been patched simultaneously. Because no workaround is available, updates to both management planes and hypervisors are required.

3. Attack Flow

Chain A: vCenter Authentication Bypass

1. An attacker reaches vCenter over the network.
2. The attacker exploits CVE-2026-59309 in the VMware Directory Service.
3. The attacker bypasses authentication and gains unauthorized access to vCenter.
4. Inference: The attacker enumerates and manipulates VMs, clusters, credentials, backups, and management settings based on the acquired privileges.

Chain B: vCenter RCE

1. An attacker reaches the vCenter Syslog server.
2. The attacker exploits CVE-2026-59310 (directory traversal).
3. The attacker executes arbitrary code on vCenter.
4. Inference: The attacker acquires service credentials, SAML-related secrets, and ESXi management paths to move laterally.

Chain C: VM Escape

1. An attacker gains local administrator privileges inside a VM.
2. The attacker confirms that the target VM uses a VMXNET3 virtual NIC.
3. The attacker triggers an out-of-bounds write via CVE-2026-47876.
4. The attacker executes code on the ESXi host and breaks the VM boundary.
5. Inference: The attacker reaches other VMs on the same host or hypervisor management information.

Chain D: DoS / Information Disclosure via VM Deployment Permissions

1. An attacker with VM deployment permissions triggers CVE-2026-41703.
2. The attacker extracts information from the ESXi host process or causes a Denial of Service (DoS), which is more likely.

4. Attacker Position and Execution Location

• The two vCenter vulnerabilities are executed by a remote attacker on the management network.
• The VM escape is executed by a local administrator inside a guest VM targeting the VMXNET3 device.
• Upon success, code is executed on the vCenter OS or the ESXi host.

5. Visibility for Victims and Administrators

• In vCenter, pre-authentication requests, Syslog processing, and abnormal file paths may be visible.
• In VM escape, high-privileged processes in the guest may be followed by vmx process crashes or anomalies.
• If VMs and hosts continue normal operations, boundary crossing cannot be detected by guest EDR alone.
• CVE-2026-41709 does not log certain administrator operations, creating a gap in existing auditing.

6. Success and Failure Conditions

Success Conditions

• Using unpatched vCenter / ESXi.
• Network accessibility to vCenter.
• VM escape requires a VM local administrator and VMXNET3.
• CVE-2026-41703 requires VM deployment permissions.

Failure Conditions

• Applying the patches listed in VMSA-2026-0006.
• Restricting the vCenter management plane to a dedicated network, jump host, and VPN with MFA.
• Minimizing guest administrator privileges.
• Securing management operations and hypervisor logs externally.

7. What Happens on Success

Unauthenticated vCenter access or code execution, code execution from a compromised VM to the ESXi host, and DoS or information disclosure of host processes can occur. Compromise of the hypervisor management plane can affect multiple VMs, backups, virtual networks, and management credentials.

8. Observable Logs

Email

• None.

Proxy / SWG / DNS

• New source IPs accessing vCenter management URLs.
• Subsequent traffic from vCenter / ESXi to unknown domains.

Endpoint / EDR

• Suspicious child processes from vCenter services.
• Abnormal file access associated with Syslog server processing.
• Abnormal operations targeting VMXNET3 inside the guest.
• Crashes and restarts of vmx, hostd, vpxd, etc.

Identity / IdP

• vCenter sessions or operations generated without authentication records.
• Unusual use of administrators or service accounts.
• Changes to SSO roles, permissions, and identity sources.

SaaS / Cloud

• Use of VMware Cloud Foundation management planes, backup integrations, and cloud connection credentials.

Network

• Connections to vCenter from outside the management segment.
• Outbound ESXi traffic immediately following the guest-to-host boundary crossing.
• Suspicious east-west access to other VMs on the same host.

9. Attack Success Determination

• Contact Only: vCenter discovery, vulnerability probing.
• User Interaction: None required.
• Initial Execution: Authentication bypass session, abnormal vCenter service processing, guest exploit execution.
• Authentication / Malware Success: Unauthenticated vCenter operations, suspicious processes on vCenter/ESXi.
• Information Theft / Session Compromise: Acquisition of vCenter secrets, VM inventory, backups, and configurations.
• Subsequent Compromise Confirmation: ESXi host code execution, other VM operations, addition of management privileges.

10. Investigation Playbook

Trigger

• Discovery of unpatched vCenter / ESXi.
• Unauthenticated management operations.
• Abnormal crashes of vmx / host processes.
• Combination of guest admin compromise and VMXNET3 usage.

Initial Verification

1. Verify products, versions/builds, and VMSA patch status.
2. Export vCenter, ESXi, SSO, Syslog, and guest logs externally.
3. Check sources of vCenter management traffic and unauthenticated requests.
4. Verify NIC types and local admin compromise on affected VMs.

Endpoints

• Investigate processes, files, and core dumps on the vCenter OS, ESXi, and guests.
• Correlate timelines of VM tools, virtual NICs, and host processes.

Authentication & Cloud

• Check vCenter SSO, roles, permissions, service accounts, certificates, and API tokens.
• Rotate credentials for backups, monitoring, and Cloud Foundation integration.

Subsequent Operations

• Audit VM power, snapshot, export, console, network, and datastore operations.
• Investigate lateral movement to other hosts or vCenters.

Containment

• Restrict the vCenter management plane and apply Broadcom patches.
• Safely migrate VMs away from suspected compromised hosts and isolate the hosts.
• Rotate management credentials and rebuild vCenter/hosts if necessary.

Determination Categories

• Vulnerable Only / vCenter Bypass / vCenter RCE / Guest Exploit / Host Escape / Cross-VM Impact

11. Defense and Detection Ideas

Single Events

• Successful unauthenticated vCenter management API calls.
• Path traversal signs in the Syslog server.
• Abnormal termination of the vmx process.
• Management state changes without corresponding logs.

Timeline Correlation

Guest Admin Compromise → VMXNET3 Anomaly → vmx/host Anomaly → ESXi Process → Other VM / Datastore Operations

Threat Hunting Perspectives

• Mismatch between vCenter access logs and SSO logs.
• Management changes occurring without corresponding audit events.
• Host crashes, management API calls, or datastore access immediately following guest compromise.

Log Gaps

• Centralized storage is required for vCenter reverse proxy, SSO, vpxd, hostd, vmkernel, guest EDR, and management API audits.

Priority Actions

1. Apply patches (no workaround available).
2. Isolate the vCenter management plane.
3. Securely export vCenter/ESXi logs externally.
4. Minimize guest administrator and VM deployment privileges.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-59309 is an authentication bypass in the vCenter Directory Service, CVSS 9.8.
• CVE-2026-59310 is RCE via directory traversal in the vCenter Syslog server, CVSS 9.8.
• CVE-2026-47876 is an out-of-bounds write in VMXNET3, allowing a VM local administrator to achieve host code execution, CVSS 9.3.
• No workarounds exist, and Broadcom has not confirmed active exploitation.

Inference

• When vCenter is compromised, the impact scope should include managed VMs, hosts, backups, and virtual networks, not just a single server.
• Investigating VM escapes is difficult without combining guest EDR and hypervisor logs.

Hypothesis

• Chaining vCenter authentication bypass or RCE with guest compromise/VM escape could lead to complete control of the virtual infrastructure.

13. MITRE ATT&CK Mapping

High Confidence

• T1190 Exploit Public-Facing Application
• T1210 Exploitation of Remote Services
• T1068 Exploitation for Privilege Escalation
• T1611 Escape to Host

Medium Confidence

• T1005 Data from Local System
• T1021 Remote Services
• T1562.002 Impair Defenses: Disable or Modify System Firewall (Low confidence for direct application to log gaps)
• T1499 Endpoint Denial of Service

14. Unknowns and Additional Investigations

• Specific formats of exploit requests and payloads.
• Execution user context during vCenter RCE.
• Stability after VMXNET3 exploit and public PoC availability.
• Scope of operations not recorded by CVE-2026-41709.
• Presence of active exploitation.

15. Impact on SOCs and Organizations

VMware products are widely used across global data centers, manufacturing, financial institutions, and enterprise environments, with vCenter serving as a Tier 0 management asset. Even if management planes are not directly exposed to the internet, they can be reached via VPNs, outsourced operations, or compromised jump hosts. Therefore, organizations should not lower prioritization based solely on the absence of external exposure.

16. Summary

For SOCs

• Focus monitoring on mismatches between vCenter access and SSO, guest-to-host timelines, and missing logs.
• Evaluate authentication bypass, vCenter RCE, and VM escape as separate stages of compromise.

For Administrators

• Apply VMSA-2026-0006 because no workaround is available.
• Isolate the vCenter management plane and secure management credentials and logs externally.

For Users

• Management infrastructure can be targeted without user interaction. Report any anomalies in VMs or management screens to administrators before rebooting.