Broadcom Patches Five Critical VMware Vulnerabilities Including CVSS 9.8 Authentication Bypass
Broadcom has issued security updates addressing five vulnerabilities in VMware products that could allow authentication bypass, code execution, and virtual machine escapes in corporate virtualized environments.
The most critical flaw, tracked as CVE-2026-59309 with a CVSS score of 9.8, affects the VMware Directory Service component of vCenter. An attacker with network access to the server can bypass authentication mechanisms and gain access without valid credentials.
Because vCenter manages hosts, virtual machines, networks, and storage, unauthorized access carries significant risk, potentially enabling infrastructure changes, service disruption, and compromise of business workloads.
Another high-severity issue, CVE-2026-47876, resides in the VMXNET3 virtual network adapter of ESX. An attacker with administrative privileges inside a virtual machine can exploit an out-of-bounds write condition to execute arbitrary code directly on the hypervisor host.
The update package also resolves an unauthorized memory read vulnerability affecting ESX, Workstation, and Fusion, as well as a logging deficiency that could allow certain administrative actions to go undetected.
No temporary mitigations are available. Administrators are advised to update vCenter to versions 9.1.0.0300, 9.0.2.0100, or 8.0 U3k, apply corresponding patches to ESX hosts and Cloud Foundation, and upgrade Workstation and Fusion to version 26H1.
Related articles
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.
CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency has added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws affect Apple macOS, Microsoft SharePoint, and VMware vCenter among other products. One of the vulnerabilities, tracked as CVE-2026-65400, allows network-based authentication bypass in macOS Screen Sharing without valid credentials. The issue received a CVSS v3.1 base score of 9.8 and is rated Critical. Apple addressed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 released on August 6. Federal agencies have been instructed to apply mitigations within three days.
Apple Releases macOS Tahoe 26.6.2 Fixing 28 Vulnerabilities Including Kernel Flaws
Apple has issued macOS Tahoe 26.6.2, addressing a total of 28 security vulnerabilities tracked under CVE identifiers. The update resolves three kernel-level issues, among them a Use After Free flaw tracked as CVE-2026-65343, an out-of-bounds memory read in CVE-2026-65349, and a memory corruption problem in CVE-2026-65330. Twenty-one of the fixed vulnerabilities affect the WebKit engine, with additional patches applied to Audio, ImageIO, and IOGPUFamily components. The release incorporates fixes that were previously tested in the macOS Golden Gate 27 beta. On the following day, Apple also shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia, eliminating the same set of 21 WebKit vulnerabilities.
Google Releases Chrome Security Update Fixing 15 Vulnerabilities Including Two Critical Flaws
Google has issued a security update for its Chrome browser that addresses 15 vulnerabilities, two of which are rated critical. The update covers Windows, macOS, and Linux platforms with specific version numbers released on August 18, 2026. Among the fixes are buffer overflow issues in WebGL and Dawn that were reported by Google since mid-July. Thirteen high-severity vulnerabilities were also resolved, including type confusion and calculation errors in the V8 engine, Use After Free flaws in Browser and WebGL, buffer overflows in ANGLE, and information leaks in Skia. Additional problems fixed involve CORS implementation weaknesses, CredentialProvider link handling, USB race conditions, and uninitialized GPU resources. The patches are being rolled out gradually over the coming days and weeks.