Forwarded from the National Institute of Cyber Security Cybersecurity Alert NISAC-200-202608-00000001

Researchers discovered that multiple VMware products contain three high-risk security vulnerabilities (CVE-2026-47876, CVE-2026-59309, and CVE-2026-59310), which are classified as Out-of-Bounds Write, Authentication Bypass, and Path Traversal vulnerabilities, respectively. Please confirm and apply patches as soon as possible.

CVE-2026-47876: An attacker who has obtained local administrator privileges on a virtual machine's VMXNET3 adapter may execute arbitrary code on the ESXi host.

CVE-2026-59309: A remote attacker who has obtained network access to VMware vCenter may exploit this vulnerability to bypass authentication and access the system without authorization.

CVE-2026-59310: A remote attacker who has obtained network access to VMware vCenter may exploit this vulnerability to execute arbitrary code.