VMware patches three critical auth bypass and VM escape flaws

Broadcom has issued security updates addressing five vulnerabilities in VMware products, three of which are rated critical. The flaws affect vCenter Server, ESXi, Workstation, and Fusion, with risks including authentication bypass, arbitrary code execution, and virtual machine escape to the host environment. The remaining two vulnerabilities are classified as moderate severity, though specific details about their impact were not disclosed in the advisory.

What happened

The critical vulnerabilities allow attackers to bypass authentication mechanisms, execute arbitrary code on affected systems, or escape from a virtual machine to gain control of the underlying host. These issues pose significant risks to environments relying on VMware for virtualization, particularly in data centers and enterprise infrastructure. The patches were released without prior public disclosure of the vulnerabilities, reducing the window for potential exploitation before mitigation.

The advisory did not specify whether any of these vulnerabilities had been exploited prior to the patch release. No reports of active attacks leveraging these flaws have been confirmed by Broadcom or independent security researchers at this time. The updates are available for download via VMware’s official channels, and administrators are advised to apply them promptly to mitigate potential risks.

What we don’t know yet

The advisory does not detail the exact attack vectors or prerequisites for exploiting these vulnerabilities, such as whether specific configurations or additional conditions are required. It also remains unclear if proof-of-concept exploits exist or if any threat actors have shown interest in these flaws prior to the patch release. Further technical analysis from security researchers may provide additional clarity in the coming days.