Forwarded National Information Sharing and Analysis Center for Cybersecurity Information Security Alert NISAC-200-202608-00000001

[Content Description]
Researchers have discovered that multiple VMware products contain three high-risk security vulnerabilities (CVE-2026-47876, CVE-2026-59309, and CVE-2026-59310), with types being Out-of-Bounds Write, Authentication Bypass, and Path Traversal respectively. Please promptly verify and perform patching.
CVE-2026-47876: An attacker who has obtained local administrator privileges on a virtual machine VMXNET3 network adapter can execute arbitrary code on the ESXi host. CVE-2026-59309: A remote attacker who has obtained network access to VMware vCenter can exploit this vulnerability to bypass authentication and access the system without authorization.
CVE-2026-59310: A remote attacker who has obtained network access to VMware vCenter can exploit this vulnerability to execute arbitrary code.

[Impacted Platforms]
VMware Cloud Foundation versions 5.x to 8.0 U3k (excluding)
VMware Cloud Foundation and VMware vSphere Foundation 9.0.x.x versions
VMware Cloud Foundation and VMware vSphere Foundation 9.1.x.x versions
VMware vCenter 8.0
VMware Telco Cloud Platform version 3.0
VMware Telco Cloud Platform versions 4.x
VMware Telco Cloud Platform versions 5.0.x
VMware Telco Cloud Platform versions 5.1.x
VMware Telco Cloud Infrastructure version 3.0
VMware ESX version 8.0

[Recommended Actions]
The official has released patches for the vulnerabilities. Please refer to the official instructions for updates. The URL is as follows: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017

[Reference]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-47876
2. https://nvd.nist.gov/vuln/detail/CVE-2026-59309
3. https://nvd.nist.gov/vuln/detail/CVE-2026-59310
4. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017