ESX: code execution on the host from a virtual machine
A flaw in the VMXNET3 virtual network adapter, rated CVSS 9.3, lets an administrator inside a virtual machine execute code on the host that runs it.
What happened
Advisory VMSA-2026-0006 includes a flaw in the VMXNET3 virtual network adapter (CVE-2026-47876), rated CVSS 9.3, that allows code execution on the host server by an attacker who already has administrator privileges inside a virtual machine. Virtual machines using other network adapters are not affected.
Why it matters
It breaks the separation between the virtual machine and the host that runs it, which is the basis of virtualisation isolation. The requirement for prior administrator access inside the VM is key to assessing the real risk.
What we recommend
Update ESX; prioritise hosts running third-party or internet-facing virtual machines; and review who has administrator privileges in each virtual machine.
Related service: Infrastructure and Cloud
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.