Critical Vulnerabilities Patched in VMware Workstation and Fusion Allowing Host Code Execution
Broadcom has published a security advisory detailing multiple vulnerabilities in VMware Workstation and VMware Fusion, classifying the most severe issue as Critical.
The advisory, released on September 3, 2026, covers two privately reported flaws: CVE-2026-59346 and CVE-2026-59347. Both can be exploited when an attacker already possesses local administrator rights inside a guest virtual machine, allowing code execution on the underlying host.
CVE-2026-59346 affects the VMXNET3 virtual network adapter and involves an integer overflow condition. Successful exploitation grants the attacker the ability to run arbitrary code directly on the host operating system. The vulnerability received a CVSS v3.1 base score of 9.3, placing it in the highest severity tier of Critical.
The second issue, CVE-2026-59347, resides in the HGFS shared-folder implementation and is a stack-based buffer overflow. Exploitation allows code execution on the host under the context of the VMX process. It carries a CVSS base score of 8.1 and is rated Important.
Broadcom has released fixes in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. Organizations and individual users are strongly encouraged to apply the updates without delay to eliminate the risk of host compromise from within guest environments.
Related articles
WordPress Patches Critical Core Vulnerability CVE-2026-87902 Affecting All Versions from 4.7.0
WordPress has released patches for a critical vulnerability in the platform's core code, tracked as CVE-2026-87902 with a CVSS score of 9.2. The flaw impacts every version from 4.7.0 through 7.1.1, meaning virtually all unpatched installations remain exposed. Because the issue resides in the base system rather than plugins or themes, even sites without any extensions installed are at risk. The vulnerability allows an unauthenticated attacker to load arbitrary PHP files from outside theme directories, which can lead to remote code execution on certain server configurations. The bug was privately reported in July by researcher Robert Ressl through HackerOne and disclosed publicly on 22 September, with no confirmed exploitation observed so far. Administrators are urged to apply the updates immediately and keep automatic updates enabled.
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.
Windows 11 Update KB5124010 Triggers Crashes in Battlefield 6 and Other Titles
An optional non-security update KB5124010 for Windows 11 versions 24H2 and 25H2 is causing sudden game crashes for players of Battlefield 6, Battlefield 2042, and titles using Easy Anti-Cheat. The patch, initially distributed to Windows Insider participants and later made available broadly in early September, leads to silent exits within 15-30 seconds or a few minutes after launch. Reinstalling games, verifying DirectX installations, and repairing anti-cheat components have failed to resolve the issue, while uninstalling KB5124010 has restored functionality in multiple cases. The crashes are suspected to stem from conflicts with anti-cheat systems, including Electronic Arts' Javelin used in Battlefield titles and Easy Anti-Cheat in games such as Wardogs, which reports error WD-L020-95bc94d86a0d. Microsoft has not officially confirmed any link to anti-cheat software, and the problems affect users across diverse hardware configurations. Players are advised to skip the optional update until further clarification or a fix is provided.