Broadcom has released security updates addressing CVE-2026-59346 and a second flaw. Users should update VMware Workstation and Fusion to the latest patched versions immediately. Apply the available patches to eliminate the vulnerability. Monitor VMware security advisories for any additional information regarding the second flaw or future updates.
Quick answers
What is CVE-2026-59346?
Broadcom has released security updates addressing CVE-2026-59346 and a second flaw. Users should update VMware Workstation and Fusion to the latest patched versions immediately. Apply the available patches to eliminate the vulnerability. Monitor VMware security advisories for any additional information regarding the second flaw or future updates.
How severe is CVE-2026-59346?
high, CVSS 9.3
Is CVE-2026-59346 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-59346 be mitigated?
Broadcom has released security updates addressing CVE-2026-59346 and a second flaw. Users should update VMware Workstation and Fusion to the latest patched versions immediately. Apply the available patches to eliminate the vulnerability. Monitor VMware security advisories for any additional information regarding the second flaw or future updates.
CVSS
9.3
Vendor
Broadcom
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
VMware Workstation, VMware Fusion
Mitigation
Broadcom has released security updates addressing CVE-2026-59346 and a second flaw. Users should update VMware Workstation and Fusion to the latest patched versions immediately. Apply the available patches to eliminate the vulnerability. Monitor VMware security advisories for any additional information regarding the second flaw or future updates.
Broadcom has released security updates for VMware Workstation and Fusion addressing two security flaws. The more severe issue, tracked as CVE-2026-59346, is an integer-overflow vulnerability with a CVSS score of 9.3. A local attacker with elevated privileges could exploit this bug to execute arbitrary code on the host system. The second flaw's details were not specified in the advisory. Exploitation requires local access and elevated privileges; no public exploit code was confirmed at the time of reporting.
