Broadcom has released emergency security updates for a critical VMware ESXi vulnerability that can allow an attacker to escape from a virtual machine and execute code on the underlying hypervisor host. Tracked as CVE-2026-47876 and rated 9.3 on the CVSS scale, the issue resides in the VMXNET3 network adapter.
Successful exploitation requires the attacker to already have local administrative privileges inside a guest virtual machine configured with VMXNET3. From that position, the attacker can trigger an out-of-bounds write and cross the isolation boundary between the guest and the ESX host.
This VM Escape Vulnerability is particularly serious in multi-tenant, cloud, and enterprise virtualization environments. Compromise of the hypervisor can expose other virtual machines, management data, application workloads, and infrastructure secrets located on the same host.
Broadcom has found no evidence that the flaw has been exploited in the wild. However, there are no available workarounds, and the company classifies the updates as an emergency change requiring prompt action.
CVE-2026-47876 analysis
The vulnerability is an out-of-bounds write in the VMXNET3 virtual network adapter implementation on the ESX side of communication with a guest machine. VMXNET3 is a high-performance network adapter commonly used in VMware environments to provide better throughput and lower overhead than emulated network devices.
An attacker must first obtain local administrator or root-level privileges inside a virtual machine using VMXNET3. The malicious actor can then interact with the virtual adapter in a way that causes data to be written beyond the intended memory boundary in the host-side component.
Memory corruption within the hypervisor process can enable the attacker to execute arbitrary code on the ESX host. This breaks one of the central security guarantees of virtualization: code running inside a guest should remain isolated from the hypervisor and other workloads.
CVE-2026-47876 affects the following supported VMware product branches when they are running builds earlier than the fixed versions:
- VMware Cloud Foundation and VMware vSphere Foundation ESX 9.1.x
- VMware Cloud Foundation and VMware vSphere Foundation ESX 9.0.x
- VMware ESXi 8.0
- VMware Cloud Foundation 5.x
- VMware Telco Cloud Platform 5.0.x and 5.1.x
Virtual machines configured with other virtual network adapters are not vulnerable through this specific attack path. However, Broadcom does not recommend switching to adapters such as e1000 as a long-term security measure because emulated adapters have their own vulnerability history and lack the performance benefits of paravirtualized drivers.
The most important details for CVE-2026-47876 concern the privilege requirement and the security boundary being crossed. The flaw is not directly exploitable by an unauthenticated internet attacker. It becomes valuable after an adversary has already compromised a guest machine and gained administrative control inside it.
This makes the bug well suited to multi-stage intrusions. An attacker could initially compromise a vulnerable application, steal privileged credentials, or exploit another guest-level flaw before using the ESXi weakness to escape the virtual machine and target the host.
The issue was privately reported by Nguyen Hoang Thach of STARLabs SG through the Pwn2Own competition operated by Trend Micro’s Zero Day Initiative. The cited sources do not identify a publicly available CVE-2026-47876 PoC, and Broadcom has not reported active exploitation.
There are also no vendor-published CVE-2026-47876 IOCs. Since exploitation occurs through interactions between a privileged guest and the virtual adapter, defenders should not expect a simple malicious file hash, IP address, or web request pattern that reliably identifies abuse.
CVE-2026-47876 Mitigation
Broadcom states that there are no workarounds that fully address the flaw. Organizations must update ESX to a fixed build rather than relying on VM configuration changes or replacing VMXNET3 with another adapter.
The relevant fixed versions include:
- ESX 9.1.x: ESXi-9.1.0.0200-25557999
- ESX 9.0.x: ESXi-9.0.2.0100-25595025
- VMware ESXi 8.0: ESXi80U3k-25595708
- VMware Cloud Foundation 5.x: Apply the corresponding asynchronous patch
- VMware Telco Cloud Platform 5.0.x and 5.1.x: Follow the vendor’s branch-specific update guidance
Broadcom notes that publicly released patches are cumulative, so administrators can install the listed fixed build or a newer supported release containing the same security correction.
CVE-2026-47876 detection should begin with an inventory of ESX hosts and their build numbers. Administrators can view build information in the Summary tab of the vSphere Client or query hosts through PowerCLI:
Get-VMHost | Select-Object Name,Version,Build
Security teams should then identify virtual machines using VMXNET3 and prioritize hosts that run untrusted, internet-facing, development, customer-controlled, or multi-tenant workloads. The use of VMXNET3 does not itself indicate compromise, but it confirms that the vulnerable attack path may be available on an unpatched host.
To Detect CVE-2026-47876 abuse, defenders should monitor for suspicious activity preceding a possible escape, including:
- Unexpected administrative privilege acquisition inside a guest VM
- Unusual kernel or driver-level activity involving virtual networking
- VMX process instability or unexplained host-process crashes
- Unauthorized changes to ESX host configuration
- New host-level processes or connections following a guest compromise
- Access from the hypervisor to other virtual machines or management systems
- Attempts to disable logging or security controls on the host
Organizations should treat any confirmed administrator-level guest compromise on an unpatched VMXNET3-enabled host as a potential hypervisor incident. Incident response should include reviewing the ESX host, neighboring workloads, vCenter activity, privileged accounts, and infrastructure credentials rather than investigating only the original guest.
Applying the update may require an ESX host restart. Broadcom recommends using vMotion to relocate workloads to alternate hosts and patching clusters through a rolling reboot process. Virtual machines that cannot be migrated must be powered down during the host restart.
Eligible environments may also use ESX Live Patch to reduce disruption. Administrators should consult the release notes for their product branch to confirm whether Live Patch is supported for the selected source and target builds.
Updating VMware Tools inside the guest does not remediate this issue. Although VMXNET3 includes an in-guest driver, the vulnerable code is on the ESX side, so the hypervisor itself must be updated.
FAQ
What is CVE-2026-47876 and how does it work?
CVE-2026-47876 is a critical out-of-bounds write vulnerability in the VMXNET3 virtual network adapter implementation in VMware ESX. An attacker with administrative privileges inside a VM using VMXNET3 can trigger memory corruption and execute code on the hypervisor host.
When was CVE-2026-47876 first discovered?
The private discovery date has not been publicly disclosed. Broadcom credits Nguyen Hoang Thach of STARLabs SG, working through the Pwn2Own competition and Trend Micro’s Zero Day Initiative, with reporting the issue. The vendor published the advisory and security updates on July 29, 2026.
What is the impact of CVE-2026-47876 on systems?
Successful exploitation can allow a malicious administrator inside a guest VM to escape the virtualized environment and execute arbitrary code on the ESX host. This may expose the hypervisor, other hosted virtual machines, sensitive infrastructure data, and connected management systems.
Can CVE-2026-47876 still affect me in 2026?
Yes. VMware environments remain exposed if they run builds earlier than the fixed versions and host a virtual machine configured with VMXNET3. Unsupported VMware branches should also be presumed vulnerable unless the vendor or an extended-support provider confirms otherwise.
How can I protect myself from CVE-2026-47876?
Install Broadcom’s fixed ESX build immediately, verify that the patched version is active, and prioritize hosts running high-risk or untrusted guest workloads. There is no complete workaround, and changing the virtual network adapter is not recommended as a substitute for updating the hypervisor.