Critical9.3VMware (Broadcom)

Critical [CVE-2026-47876] VMXNET3 out-of-bounds write vulnerability

This critical-severity VMware (Broadcom) advisory covers CVE-2026-47876 affecting Cloud Foundation, vSphere Foundation, ESX.

CVE-2026-47876 Published Jul 30, 2026Updated by vendor Jul 30, 2026

CVE-2026-47876

Affected products & platforms

VMware (Broadcom)ESXiCloud FoundationvSphere

Open vendor advisory

Android app · Google Play

Monitor future VMware (Broadcom) CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.

Non VMXNET3 virtual adapters are not affected by this issue. Affected products named by the advisory: Cloud Foundation; vSphere Foundation; Telco Cloud Platform.

Affected versions

Cloud Foundation 9.1.x.x
Cloud Foundation 9.0.x.x
Cloud Foundation 5.x
vSphere Foundation 9.1.x.x
vSphere Foundation 9.0.x.x
ESX 9.1.x.x before ESXi-9.1.0.0200-25557999
ESX 9.0.x.x before ESXi-9.0.2.0100-25595025
ESX 8.0 before ESXi80U3k-25595708
Telco Cloud Platform 5.1.x
Telco Cloud Platform 5.0.x

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

ESXi-9.1.0.0200-25557999
ESXi-9.0.2.0100-25595025
ESXi80U3k-25595708

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation

Upgrade to a fixed release: ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
VMware (Broadcom)
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation. Discovered from the machine-readable feed https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/delta.json; this link opens the CVE.org record for CVE-2026-47876 instead of the raw feed document.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-47876NVD CVE.org MITRE

Official resources

Broadcom support downloads (ESXi / vCenter patches) (target: 9.1.0.0200-25557999 / 9.0.2.0100-25595025 / 80U3k-25595708)
Official documentation
This advisory names 9.1.0.0200-25557999 / 9.0.2.0100-25595025 / 80U3k-25595708 as the first fixed releases — official upgrade documentation for vSphere (ESXi / vCenter).
VMware product lifecycle (EOL / support dates)
Release notes
Confirm your release train is still supported before planning the upgrade path.
Broadcom / VMware Security Advisories (VMSA)
Official documentation
Canonical VMSA portal — full advisory text, response matrix and fixed-version tables.
VMware docs on Broadcom TechDocs
Official documentation
Official VMware product documentation, including upgrade and patching guides.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.