PENTESTY · EDITORIAL ANALYSIS · · 4 min read
VMware in the lab: did the update reach the workstation opening the VMs?
A test VM also depends on software installed on its workstation. Establish where remediation belongs and which evidence supports resuming the work.
By Pentesty
The September advisory identifies two mechanisms
Broadcom’s VMSA-2026-0007, published September 3, 2026, describes CVE-2026-59346 in VMXNET3 and CVE-2026-59347 in HGFS. The former can allow code execution on the host; the latter, as the VMX process. Both require local administration inside the VM according to the vendor’s description. Its matrix lists Workstation and Fusion 25H2/26H1 and identifies 26H1u1 as fixed, with no workaround. The advisory does not list ESXi or vCenter.
A test workstation is an asset with an owner
Imagine a team receiving a vendor demonstration VM. The image is opened on a laptop also used for development. Before execution, its owner needs to establish which product is installed, which version is running and which host resources are available to the guest. Calling it a laboratory does not answer those questions.
Maintain the inventory at workstation level rather than relying on the VM image. Connect the accountable user, host operating system, Workstation or Fusion product, observed version and intended purpose. Include machines occasionally used for support, training or testing, which may be missing from a virtualization-server inventory.
Keep the network adapter and HGFS conditions distinct
When comparing a workstation with the advisory, record its configured adapter and existing shares. These details help explain lab conditions and dependencies. They do not replace the fixed version identified by the vendor, or establish that disabling one integration addresses both vulnerabilities.
Also review which data the guest genuinely needs. A temporary folder containing fictional files serves a different purpose from a directory holding projects and personal credentials. Reduce unnecessary access and document required access, without presenting this review as a workaround recognized by the advisory.
Separate installation, execution and return to service
Plan maintenance with the workstation’s users and follow the supported procedure for the product. Before changing it, record the VMs that need preserving and conditions for resuming work. Afterwards, check the product actually opened and its version, rather than closing the task because an installer was downloaded.
Choose a controlled VM containing synthetic data to validate legitimate operation after maintenance. The exercise can cover startup, shutdown, necessary connectivity and an expressly permitted file exchange. It demonstrates observed continuity and configuration without reproducing an escape or certifying resistance to every attack.
- Before the change: workstation, product, version, relevant VMs and maintenance owner.
- After installation: evidence of the version in use and the applicable advisory reference.
- At resumption: approved task outcomes, necessary integrations and outstanding exceptions.
Restoration can reopen the maintenance issue
Consider recovery of the workstation itself. If it returns from an image created before maintenance, the team needs to check the software running the VMs again. A guest snapshot describes a different state and cannot establish remediation of the product installed on the host.
Our analysis of KVM on ARM64 with nested virtualization concerns a different mechanism but helps locate the layer responsible for isolation. The review of components actually loaded develops the distinction between available remediation and observed state. Preserve that distinction when closing maintenance.
Acceptance should state what was verified
Provide a short record of covered assets, versions, comparison with the matrix and legitimate task outcomes. If a workstation could not be updated, identify the open issue and who decides whether it may be used. Temporarily restricting activities can form part of that decision, but should not be described as technical remediation already applied.
Frequently asked questions
Are these remote attacks requiring no prior access?
The vendor describes local administration inside the VM as a condition for both. Do not turn this into a direct internet attack against any workstation.
Is updating only the VM operating system sufficient?
The advisory concerns Workstation and Fusion running it. Identify and update the affected product at the layer specified by official documentation.
Does disabling shared folders replace the patch?
The advisory lists no workaround. Reviewing integrations is a configuration decision; do not present it as remediation of both vulnerabilities.
Do we need to execute a proof of concept?
The proposed review checks deployment and operation with legitimate workloads. An escape-specific assessment requires its own authorization, environment and method.
Sources and references
- Broadcom: VMSA-2026-0007 for Workstation and Fusion
- CVE: VMware primary record for CVE-2026-59346
- CVE: VMware primary record for CVE-2026-59347
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.