Broadcom releases critical patches for VMware vCenter, ESXi

Broadcom has released a set of critical security patches for its widely used VMware virtualization software, addressing multiple vulnerabilities that could allow attackers to bypass authentication, execute remote code, and even escape from a virtual machine to compromise the underlying host. The company published the advisory, VMSA20260006, on July 29, 2026, urging customers to apply the updates immediately.

The update addresses five vulnerabilities, three of which are rated critical. The most severe are two flaws in vCenter Server, VMware's centralized management platform. The first, tracked as CVE-2026-59309, is an authentication bypass in the VMware Directory Service. According to Broadcom, a remote attacker with network access to a vulnerable vCenter Server can exploit this flaw to gain unauthorized access to the system without requiring any credentials. The second, CVE-2026-59310, is a directory traversal vulnerability in vCenter's Syslog server that could allow a remote attacker to execute arbitrary code. Both carry a maximum CVSS severity score of 9.8.

A third critical vulnerability, CVE-2026-47876, poses a significant threat to the hypervisor layer. With a CVSS score of...