Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape

Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter. "A malicious actor with network access to vCenter

The article reports that Broadcom released patches for multiple critical vulnerabilities in VMware ESX, vCenter, Workstation, and Fusion, including CVE-2026-59309, an authentication bypass in the vCenter Directory Service that allows a network-based attacker to gain unauthorized access to the management plane and control virtual infrastructure.[1][3][13] Additional flaws enable remote code execution and VM escape from a compromised guest to the ESXi host, with no available workarounds, making timely updates to both management planes and hypervisors mandatory.[1][13] From a RealGround perspective, these issues represent a significant AI supply chain risk because many AI workloads and orchestration systems run inside VMware-based virtualized infrastructure; compromise of vCenter or ESXi can give an attacker indirect control over AI systems, data, and models hosted on those VMs. Organizations should treat these VMware components as critical third-party infrastructure in their AI stack, ensure rapid patch management, maintain an SBOM and asset inventory for virtualization layers, and include hypervisor and management-plane compromise scenarios in continuous AI red teaming and resil