VMware Produkte: Mehrere Schwachstellen
WID-SEC-2026-2569 · first 29.07.2026 · updated 29.10.2026 · CVSS 9,8
What it is about
Die Virtualisierungssoftware von VMware ermöglicht die simultane Ausführung von verschiedenen Betriebssystemen auf einem Host-System. Ein Angreifer kann mehrere Schwachstellen in VMware ESXi, VMware vCenter Server, VMware Workstation und VMware Fusion ausnutzen, um einen Denial of Service zuverursachen, Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Code auszuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service zuverursachen
- Informationen offenzulegen
- Sicherheitsmaßnahmen zu umgehen
- Code auszuführen
Am I affected?
Affected according to the BSI:
- VMware Workstation
- VMware ESXi
- Google Cloud Platform
- VMware Fusion
- VMware vCenter Server
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Install the updates provided by the vendor; details in the sources below.
Is the vulnerability already being exploited?
- CVE-2026-41709: exploited in the wild according to CISA, in the catalogue since 28.10.2026.
- CVE-2026-59310: exploited in the wild according to CISA, in the catalogue since 18.08.2026, also for ransomware.
Information and sources
- Original BSI advisory (WID)
- VMware Security Advisory VMSA-2026-0006 vom 2026-07-28 support.broadcom.com
- Google Cloud Platform Security Bulletin GCP-2026-050 vom 2026-07-29 docs.cloud.google.com
- Google Cloud Platform Security Bulletin GCP-2026-051 vom 2026-07-31 docs.cloud.google.com
- QUIRSO Threat Research team vom 2026-08-10 medium.com
- Exploit CVE-2026-41709 www.cisa.gov
CVE: CVE-2026-41703, CVE-2026-41709, CVE-2026-47876, CVE-2026-59309, CVE-2026-59310
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.