Broadcom Patches Critical VMware ESXi Flaws Allowing Host Escape

SAN JOSE — Broadcom released critical security updates Tuesday for its VMware portfolio, addressing severe vulnerabilities in the widely used ESXi hypervisor that could allow attackers to escape virtual machine isolation and execute arbitrary code on host systems. The patches also cover related products including vCenter Server, Workstation, and Fusion.

The advisory, issued on July 29, 2026, details a cluster of flaws within the VMware infrastructure stack. Security researchers identified that unpatched versions of ESXi contain defects enabling "VM escape," an attack vector where malicious actors break out of a contained virtual environment to compromise the underlying physical host. Once inside the host system, attackers could potentially gain unauthorized access to other virtual machines running on the same server, effectively breaching network segmentation and exposing sensitive data across entire enterprise environments.

Broadcom stated that the vulnerabilities stem from improper input validation and memory handling errors within the hypervisor kernel and management interfaces. Exploitation of these flaws does not require user interaction in some scenarios, allowing remote attackers to initiate code execution with root privileges on the host machine. The update applies broadly across VMware's virtualization suite, ensuring consistency for organizations managing hybrid cloud infrastructures.

The company urged administrators to apply the patches immediately via standard update mechanisms or by downloading specific hotfixes from the official support portal. Broadcom emphasized that delaying updates leaves systems exposed to active exploitation in the wild, noting that proof-of-concept exploits have already been observed targeting unpatched versions of ESXi 7.x and 8.x.

While the primary focus remains on server-side hypervisors, the update also addresses similar risks in desktop virtualization products. VMware Workstation for Windows and Linux, along with Fusion for macOS users, received concurrent patches to close gaps that could allow local attackers or compromised guest OS instances to elevate privileges on host workstations.

The scale of potential impact is significant given VMware's dominance in enterprise data centers globally. Many organizations rely on ESXi as the foundation for their cloud-native applications and legacy server consolidation efforts. A successful breach via these vulnerabilities could lead to widespread service disruption, ransomware deployment, or exfiltration of intellectual property stored within virtualized workloads.

As administrators begin deploying the fixes across global networks, questions remain regarding whether any organizations have already been compromised using these specific vectors before Tuesday's release. Security firms are monitoring dark web channels and threat intelligence feeds for indicators of active campaigns leveraging the disclosed flaws. Broadcom has not commented on confirmed incidents but continues to work with affected customers to ensure rapid remediation.